a2f53498dfb974cf6a6358bdf3a5d0745af839e3b9fe32fb9dc328519c61971e

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_a2f53498dfb974cf6a6358bdf3a5d0745af839e3b9fe32fb9dc328519c61971e.exe
Size 48KB
Sample260924-e7rm2syxax
SHA256 a2f53498dfb974cf6a6358bdf3a5d0745af839e3b9fe32fb9dc328519c61971e
MD5 5d52f5600375c4ae3ccebbe6e76b4eca
SHA1 5f0cf657dd16fab8827917a207572433e8c67eae
SHA512 1cd51ca86a8bef5898823ddca0600e674289e511e5e5607a795985ab2f0c7c1637e096315b1ea54d068be63f45807234ce43685abbc64551f6dbafe8692c72fc
SSDEEP 384:Uz/dHfxxkvNg4lzlNMnuMLAIPs6H5A9TU52QL0yLjLNq5R0pct5Jtfnnxi0:q/dHfDYNgucu2AX6ZdM1yX5Xat53fnnF
TLSH
T19E235B8B962568B2CADF043431FF6B270F769D38C62D88E3CBE719C69C31547892591A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4116	micsusk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\micsus.dll	jaffacakes118_a2f53498dfb974cf6a6358bdf3a5d0745af839e3b9fe32fb9dc328519c61971e.exe
File created	C:\Windows\SysWOW64\micsusk.exe	jaffacakes118_a2f53498dfb974cf6a6358bdf3a5d0745af839e3b9fe32fb9dc328519c61971e.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4904	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_a2f53498dfb974cf6a6358bdf3a5d0745af839e3b9fe32fb9dc328519c61971e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	micsusk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4116	4564	jaffacakes118_a2f53498dfb974cf6a6358bdf3a5d0745af839e3b9fe32fb9dc328519c61971e.exe	90
PID 4564 wrote to memory of 4904	4564	jaffacakes118_a2f53498dfb974cf6a6358bdf3a5d0745af839e3b9fe32fb9dc328519c61971e.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a2f53498dfb974cf6a6358bdf3a5d0745af839e3b9fe32fb9dc328519c61971e.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a2f53498dfb974cf6a6358bdf3a5d0745af839e3b9fe32fb9dc328519c61971e.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\micsusk.exe
  C:\Windows\system32\micsusk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a2f53498dfb974cf6a6358bdf3a5d0745af839e3b9fe32fb9dc328519c61971e.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_a2f53498dfb974cf6a6358bdf3a5d0745af839e3b9fe32fb9dc328519c61971e.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a2f53498dfb974cf6a6358bdf3a5d0745af839e3b9fe32fb9dc328519c61971e.exe.bat
Size 274B
SHA256 5ffa2f989b57236d9781595fddd9349b3357b9345dded7ca0329e0352f22efe0
MD5 ebef7de6f79274da4f4c11f87a3f581e
SHA1 5b6e80a3d5c4767c2416977b47b1c1caa6d85052
SHA512 4d2c32b1d0ef953b02858b07665fb7bf00dba7d5e7ccd11fdbc50b7d024271052974ac359dba93fcaafae5c0c78eb78569cc0020dd2882ed98553c12cef008d7
TLSH
T1C9D0C2411103916F1C40E80F01301E8C405A8864329D2B1B933382BD237333C76BE600
MD5 SHA1 SHA512 TLSH

Submit Download

micsusk.exe

Path C:\Windows\SysWOW64\micsusk.exe
Size 48KB
SHA256 a2f53498dfb974cf6a6358bdf3a5d0745af839e3b9fe32fb9dc328519c61971e
MD5 5d52f5600375c4ae3ccebbe6e76b4eca
SHA1 5f0cf657dd16fab8827917a207572433e8c67eae
SHA512 1cd51ca86a8bef5898823ddca0600e674289e511e5e5607a795985ab2f0c7c1637e096315b1ea54d068be63f45807234ce43685abbc64551f6dbafe8692c72fc
SSDEEP 384:Uz/dHfxxkvNg4lzlNMnuMLAIPs6H5A9TU52QL0yLjLNq5R0pct5Jtfnnxi0:q/dHfDYNgucu2AX6ZdM1yX5Xat53fnnF
TLSH
T19E235B8B962568B2CADF043431FF6B270F769D38C62D88E3CBE719C69C31547892591A
MD5 SHA1 SHA512 SSDEEP TLSH