9af033a12fc126198cd9fbf497a9d2ecf532eeee2d7c48ef2d442e64ec6efa1a

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_9af033a12fc126198cd9fbf497a9d2ecf532eeee2d7c48ef2d442e64ec6efa1a.exe
Size 48KB
Sample260924-fmdfcs114p
SHA256 9af033a12fc126198cd9fbf497a9d2ecf532eeee2d7c48ef2d442e64ec6efa1a
MD5 0b6157235f1d0e4fb4523518c1a8f024
SHA1 c9e5528233368c30f97b39f5d72ba0656dc64dcb
SHA512 17acc7098739725defd7af1c40450f7b3b9a1c1da66163f6b519a38d0cc559fff3784099c1ff1986347991d2aea1c1eebb6fc95d997e0b4e210a85ade6cb3dfa
SSDEEP 384:HQwwP1nieKC20sCfzvvTF2UcnKRXihD1jO6JD7zxnGIdmScarXE4:CPtRI0BHTFp0KRXsBj8SLrXL
TLSH
T1D0231A4F36C0E8F1D25F0030AEA5E9A72EBC7D36A45AB897B963774D11785161358E03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
1200	craoek.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\craoek.exe	jaffacakes118_9af033a12fc126198cd9fbf497a9d2ecf532eeee2d7c48ef2d442e64ec6efa1a.exe
File created	C:\Windows\SysWOW64\craoe.dll	jaffacakes118_9af033a12fc126198cd9fbf497a9d2ecf532eeee2d7c48ef2d442e64ec6efa1a.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1888	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_9af033a12fc126198cd9fbf497a9d2ecf532eeee2d7c48ef2d442e64ec6efa1a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	craoek.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1200	1944	jaffacakes118_9af033a12fc126198cd9fbf497a9d2ecf532eeee2d7c48ef2d442e64ec6efa1a.exe	90
PID 1944 wrote to memory of 1888	1944	jaffacakes118_9af033a12fc126198cd9fbf497a9d2ecf532eeee2d7c48ef2d442e64ec6efa1a.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9af033a12fc126198cd9fbf497a9d2ecf532eeee2d7c48ef2d442e64ec6efa1a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9af033a12fc126198cd9fbf497a9d2ecf532eeee2d7c48ef2d442e64ec6efa1a.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\craoek.exe
  C:\Windows\system32\craoek.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9af033a12fc126198cd9fbf497a9d2ecf532eeee2d7c48ef2d442e64ec6efa1a.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_9af033a12fc126198cd9fbf497a9d2ecf532eeee2d7c48ef2d442e64ec6efa1a.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9af033a12fc126198cd9fbf497a9d2ecf532eeee2d7c48ef2d442e64ec6efa1a.exe.bat
Size 274B
SHA256 7089db9af6b54a7ef7c2bae327a2cae9237f18bf0dd3ce4e16c81d14d0dd48b0
MD5 53b59ea35df3a9db6d95c3c4c3356f11
SHA1 2192c021896bfa28a92f8a69ad8be92e158b0653
SHA512 75d0c1b320a94e3bf0106dba7dc477683406f3157c666476d25c39d648e5daabd14c4635764c2da5fa5279c599d3e72c75eb2fb9964af927d013d86bf37b1d08
TLSH
T1E6D02B8AD193401A6854D43F11202D4440900DF6535C2F620231C1C0E76540EBD83748
MD5 SHA1 SHA512 TLSH

Submit Download

craoek.exe

Path C:\Windows\SysWOW64\craoek.exe
Size 48KB
SHA256 9af033a12fc126198cd9fbf497a9d2ecf532eeee2d7c48ef2d442e64ec6efa1a
MD5 0b6157235f1d0e4fb4523518c1a8f024
SHA1 c9e5528233368c30f97b39f5d72ba0656dc64dcb
SHA512 17acc7098739725defd7af1c40450f7b3b9a1c1da66163f6b519a38d0cc559fff3784099c1ff1986347991d2aea1c1eebb6fc95d997e0b4e210a85ade6cb3dfa
SSDEEP 384:HQwwP1nieKC20sCfzvvTF2UcnKRXihD1jO6JD7zxnGIdmScarXE4:CPtRI0BHTFp0KRXsBj8SLrXL
TLSH
T1D0231A4F36C0E8F1D25F0030AEA5E9A72EBC7D36A45AB897B963774D11785161358E03
MD5 SHA1 SHA512 SSDEEP TLSH