f310560894ceb2335b811cde712a93ba3fc7eca09ad338e8cc832452817cb76a

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_f310560894ceb2335b811cde712a93ba3fc7eca09ad338e8cc832452817cb76a.exe
Size 48KB
Sample260924-e6ft6a1x3m
SHA256 f310560894ceb2335b811cde712a93ba3fc7eca09ad338e8cc832452817cb76a
MD5 1201a541623291f1a9bf1bc8c9c790cd
SHA1 e0a5f4628da47b952802cfa889ba6457aae126ba
SHA512 6b515f88d4c2fae0ff8ce521299ba29803ade60d815f50ee5643d8c0733cbcb3cbdd634279e041695aed6f3901397d4933d190a1294f6c876e14c5296bd04fa4
SSDEEP 768:5O6O0cF/YAzVJHrLT/fQ6q2a10F9ZLzfnUhZ8cj8YGdB:5ATGAVJHrLT/fLU98X
TLSH
T159234A4B6A8A98F2D3D90ABD35E729064FB7BE340F6748C7CBFB92C46670547412450B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4108	eskislk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\eskisl.dll	jaffacakes118_f310560894ceb2335b811cde712a93ba3fc7eca09ad338e8cc832452817cb76a.exe
File created	C:\Windows\SysWOW64\eskislk.exe	jaffacakes118_f310560894ceb2335b811cde712a93ba3fc7eca09ad338e8cc832452817cb76a.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5944	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_f310560894ceb2335b811cde712a93ba3fc7eca09ad338e8cc832452817cb76a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eskislk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5932 wrote to memory of 4108	5932	jaffacakes118_f310560894ceb2335b811cde712a93ba3fc7eca09ad338e8cc832452817cb76a.exe	89
PID 5932 wrote to memory of 5944	5932	jaffacakes118_f310560894ceb2335b811cde712a93ba3fc7eca09ad338e8cc832452817cb76a.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f310560894ceb2335b811cde712a93ba3fc7eca09ad338e8cc832452817cb76a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f310560894ceb2335b811cde712a93ba3fc7eca09ad338e8cc832452817cb76a.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5932
- C:\Windows\SysWOW64\eskislk.exe
  C:\Windows\system32\eskislk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f310560894ceb2335b811cde712a93ba3fc7eca09ad338e8cc832452817cb76a.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_f310560894ceb2335b811cde712a93ba3fc7eca09ad338e8cc832452817cb76a.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f310560894ceb2335b811cde712a93ba3fc7eca09ad338e8cc832452817cb76a.exe.bat
Size 274B
SHA256 d48333157a538c9fd0f76336215d3f9162715658103fbc5130b0e3754237cd5e
MD5 28773f33836ffe0d0bc6ee8aa10bdb32
SHA1 c4096644220dd8bf71eb8d380bc988bbe0ffce5a
SHA512 6c20c60b87750844268370b55131a30614cec87cf2daecb48a527a0cdd7510e4118843e1ecd46f0fa3fed04a69ded3b935331314fc2fee7c4f025886fe036987
TLSH
T15AD02B508059C6169C18E69FF92C598582200BC523C51F109712CDE80062C0CF5C9A09
MD5 SHA1 SHA512 TLSH

Submit Download

eskislk.exe

Path C:\Windows\SysWOW64\eskislk.exe
Size 48KB
SHA256 f310560894ceb2335b811cde712a93ba3fc7eca09ad338e8cc832452817cb76a
MD5 1201a541623291f1a9bf1bc8c9c790cd
SHA1 e0a5f4628da47b952802cfa889ba6457aae126ba
SHA512 6b515f88d4c2fae0ff8ce521299ba29803ade60d815f50ee5643d8c0733cbcb3cbdd634279e041695aed6f3901397d4933d190a1294f6c876e14c5296bd04fa4
SSDEEP 768:5O6O0cF/YAzVJHrLT/fQ6q2a10F9ZLzfnUhZ8cj8YGdB:5ATGAVJHrLT/fLU98X
TLSH
T159234A4B6A8A98F2D3D90ABD35E729064FB7BE340F6748C7CBFB92C46670547412450B
MD5 SHA1 SHA512 SSDEEP TLSH