91e8857ac359fea22a7d48c9bfb187c9ca85c5fc9b8b86c221714517eced27ac

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_91e8857ac359fea22a7d48c9bfb187c9ca85c5fc9b8b86c221714517eced27ac.exe
Size 48KB
Sample260924-e5dcms1w8r
SHA256 91e8857ac359fea22a7d48c9bfb187c9ca85c5fc9b8b86c221714517eced27ac
MD5 fa1f29aea2c76d1a4bfdc3b77e7f68a5
SHA1 111144e1331ace243204498f2154ff1f33a38390
SHA512 3430bf630ad21f2f745c363eaefbf6662a27a9159b7bf2a9126fd4fea5135e7a1ef65e8540b001aa9e02007fbff60866daf5d4c4c8d68fe844045d877e8e8a00
SSDEEP 768:5O6O0cF/YAzVJHrLT/fQ6q2a10F9ZLzfnUhZ8cj8YXdBt:5ATGAVJHrLT/fLU98Mt
TLSH
T15B234A4B6A8A98F2D3D90ABD35E729064FB7BE340B6748C7CBFB92C46670547412450B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4848	eskislk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\eskisl.dll	jaffacakes118_91e8857ac359fea22a7d48c9bfb187c9ca85c5fc9b8b86c221714517eced27ac.exe
File created	C:\Windows\SysWOW64\eskislk.exe	jaffacakes118_91e8857ac359fea22a7d48c9bfb187c9ca85c5fc9b8b86c221714517eced27ac.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4720	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_91e8857ac359fea22a7d48c9bfb187c9ca85c5fc9b8b86c221714517eced27ac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eskislk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 4848	1280	jaffacakes118_91e8857ac359fea22a7d48c9bfb187c9ca85c5fc9b8b86c221714517eced27ac.exe	89
PID 1280 wrote to memory of 4720	1280	jaffacakes118_91e8857ac359fea22a7d48c9bfb187c9ca85c5fc9b8b86c221714517eced27ac.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_91e8857ac359fea22a7d48c9bfb187c9ca85c5fc9b8b86c221714517eced27ac.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_91e8857ac359fea22a7d48c9bfb187c9ca85c5fc9b8b86c221714517eced27ac.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\eskislk.exe
  C:\Windows\system32\eskislk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_91e8857ac359fea22a7d48c9bfb187c9ca85c5fc9b8b86c221714517eced27ac.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_91e8857ac359fea22a7d48c9bfb187c9ca85c5fc9b8b86c221714517eced27ac.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_91e8857ac359fea22a7d48c9bfb187c9ca85c5fc9b8b86c221714517eced27ac.exe.bat
Size 274B
SHA256 3622e54d6efba37d76011f27f33f1f65de4e0766f00df64ee58b0cbab4fbb574
MD5 5cb57bf959c70519a8d8212de821cf49
SHA1 99622a048f812674eb76bafe4e1c233cb7f24875
SHA512 44e2b901e69e0bb36b08161c86d30d94e489feb7e9691da8c7cc6dfec03bcd478f0f2b00a9d428141bee1ecc2e522339eb3e56b9b2454d92e7161fe2a33aa309
TLSH
T1B3D0C295405B43AB4405F50F473B670CC12089A43E8B5F63053246BC2C634B4BE97320
MD5 SHA1 SHA512 TLSH

Submit Download

eskislk.exe

Path C:\Windows\SysWOW64\eskislk.exe
Size 48KB
SHA256 91e8857ac359fea22a7d48c9bfb187c9ca85c5fc9b8b86c221714517eced27ac
MD5 fa1f29aea2c76d1a4bfdc3b77e7f68a5
SHA1 111144e1331ace243204498f2154ff1f33a38390
SHA512 3430bf630ad21f2f745c363eaefbf6662a27a9159b7bf2a9126fd4fea5135e7a1ef65e8540b001aa9e02007fbff60866daf5d4c4c8d68fe844045d877e8e8a00
SSDEEP 768:5O6O0cF/YAzVJHrLT/fQ6q2a10F9ZLzfnUhZ8cj8YXdBt:5ATGAVJHrLT/fLU98Mt
TLSH
T15B234A4B6A8A98F2D3D90ABD35E729064FB7BE340B6748C7CBFB92C46670547412450B
MD5 SHA1 SHA512 SSDEEP TLSH