678968080fe87af3286c268452aac528139e4116a24abfe8e41c681a6a985b8f

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_678968080fe87af3286c268452aac528139e4116a24abfe8e41c681a6a985b8f.exe
Size 44KB
Sample260924-fe4ycaeb93
SHA256 678968080fe87af3286c268452aac528139e4116a24abfe8e41c681a6a985b8f
MD5 40b435e71081eca1efa6227064fecc61
SHA1 175b13eec8bf53b7cfcf7662b1ee5c309f8aecc7
SHA512 8f476e7a4700e3a4d722201dc1e7c88b322ca7faed31ba361c51a7ca3e41adc0472dd1848c349b54fbc198881bd0440da62cba9ffab8914202c0f01c2d312f28
SSDEEP 192:oFign3mWS4ds+vxPu4PMhgMQZVzbnM6uKMlnTzENw2zmZSmFhpct5U9J0w:o0gn2H4BvrtPZZbM62lnTAMZSehpct5
TLSH
T19D135A472E0058F3D2D94071392B76369BBAA832977B8897DB736FD5AC301E84D32107
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4032	jsedfk.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\jsedf.dll	jaffacakes118_678968080fe87af3286c268452aac528139e4116a24abfe8e41c681a6a985b8f.exe
File created	C:\Windows\SysWOW64\jsedfk.exe	jaffacakes118_678968080fe87af3286c268452aac528139e4116a24abfe8e41c681a6a985b8f.exe
File opened for modification	C:\Windows\SysWOW64\jsedfk.exe	jaffacakes118_678968080fe87af3286c268452aac528139e4116a24abfe8e41c681a6a985b8f.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
204	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsedfk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_678968080fe87af3286c268452aac528139e4116a24abfe8e41c681a6a985b8f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2372	jaffacakes118_678968080fe87af3286c268452aac528139e4116a24abfe8e41c681a6a985b8f.exe
2372	jaffacakes118_678968080fe87af3286c268452aac528139e4116a24abfe8e41c681a6a985b8f.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 4032	2372	jaffacakes118_678968080fe87af3286c268452aac528139e4116a24abfe8e41c681a6a985b8f.exe	95
PID 2372 wrote to memory of 204	2372	jaffacakes118_678968080fe87af3286c268452aac528139e4116a24abfe8e41c681a6a985b8f.exe	97

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_678968080fe87af3286c268452aac528139e4116a24abfe8e41c681a6a985b8f.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_678968080fe87af3286c268452aac528139e4116a24abfe8e41c681a6a985b8f.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\jsedfk.exe
  C:\Windows\system32\jsedfk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_678968080fe87af3286c268452aac528139e4116a24abfe8e41c681a6a985b8f.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_678968080fe87af3286c268452aac528139e4116a24abfe8e41c681a6a985b8f.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_678968080fe87af3286c268452aac528139e4116a24abfe8e41c681a6a985b8f.exe.bat
Size 274B
SHA256 1930c0a6fa4abf1fb3aa7e4173cffeb148f4d32fb3ae333b34f2b23f27b65ab9
MD5 ecb49c5ffd6e71138ea084aad286a3ba
SHA1 7df0900b2a01daae7290b0c78211ac6a982f1c2b
SHA512 4983fc7623235d60ad047ccba55f5409a8f43610ef42ae665634dca04c6d21118508bb2440ba77dbb2e65ef039c260db84f4ef028bd11297c5c1b1cc8fa6b6fc
TLSH
T19DD02B80E173C98A0C2DC14F40348EC9B2124B693BCA3B693B30D3E18071428B6E1684
MD5 SHA1 SHA512 TLSH

Submit Download

jsedfk.exe

Path C:\Windows\SysWOW64\jsedfk.exe
Size 44KB
SHA256 678968080fe87af3286c268452aac528139e4116a24abfe8e41c681a6a985b8f
MD5 40b435e71081eca1efa6227064fecc61
SHA1 175b13eec8bf53b7cfcf7662b1ee5c309f8aecc7
SHA512 8f476e7a4700e3a4d722201dc1e7c88b322ca7faed31ba361c51a7ca3e41adc0472dd1848c349b54fbc198881bd0440da62cba9ffab8914202c0f01c2d312f28
SSDEEP 192:oFign3mWS4ds+vxPu4PMhgMQZVzbnM6uKMlnTzENw2zmZSmFhpct5U9J0w:o0gn2H4BvrtPZZbM62lnTAMZSehpct5
TLSH
T19D135A472E0058F3D2D94071392B76369BBAA832977B8897DB736FD5AC301E84D32107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download