f4a5fd3d4daf5726e8bef9a7a2c0749f5d1e8d0599af24b56624a2128c74ef10

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_f4a5fd3d4daf5726e8bef9a7a2c0749f5d1e8d0599af24b56624a2128c74ef10.exe
Size 48KB
Sample260924-fx4ejast2q
SHA256 f4a5fd3d4daf5726e8bef9a7a2c0749f5d1e8d0599af24b56624a2128c74ef10
MD5 8832e6fcea88b042b2cd2ff53e767c91
SHA1 48887e8377400aa0ab3743bd22c2d42552859b09
SHA512 b7538b12aa871781db8acfec7cdac026153319aac5b000f7b924015e9796d04227a8bef49edfd8e1c7d16eb78d65b33e3f349b36cbb85e2f2c37c47c8bb4bf7c
SSDEEP 384:pijoiEa+tvYSi4unIGAj7iQefC7TqIm/q7crN2:oEijmYSuJA6QefC7Ta/qyN2
TLSH
T1AE235CCF994220F1C5EE053032E579176EBA8E3826DC10B7DFA75894BF7508B6198E07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
2892	zesttnsk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zesttns.dll	jaffacakes118_f4a5fd3d4daf5726e8bef9a7a2c0749f5d1e8d0599af24b56624a2128c74ef10.exe
File created	C:\Windows\SysWOW64\zesttnsk.exe	jaffacakes118_f4a5fd3d4daf5726e8bef9a7a2c0749f5d1e8d0599af24b56624a2128c74ef10.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3700	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_f4a5fd3d4daf5726e8bef9a7a2c0749f5d1e8d0599af24b56624a2128c74ef10.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zesttnsk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2372	jaffacakes118_f4a5fd3d4daf5726e8bef9a7a2c0749f5d1e8d0599af24b56624a2128c74ef10.exe
2372	jaffacakes118_f4a5fd3d4daf5726e8bef9a7a2c0749f5d1e8d0599af24b56624a2128c74ef10.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2892	2372	jaffacakes118_f4a5fd3d4daf5726e8bef9a7a2c0749f5d1e8d0599af24b56624a2128c74ef10.exe	88
PID 2372 wrote to memory of 3700	2372	jaffacakes118_f4a5fd3d4daf5726e8bef9a7a2c0749f5d1e8d0599af24b56624a2128c74ef10.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f4a5fd3d4daf5726e8bef9a7a2c0749f5d1e8d0599af24b56624a2128c74ef10.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f4a5fd3d4daf5726e8bef9a7a2c0749f5d1e8d0599af24b56624a2128c74ef10.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\zesttnsk.exe
  C:\Windows\system32\zesttnsk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f4a5fd3d4daf5726e8bef9a7a2c0749f5d1e8d0599af24b56624a2128c74ef10.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_f4a5fd3d4daf5726e8bef9a7a2c0749f5d1e8d0599af24b56624a2128c74ef10.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f4a5fd3d4daf5726e8bef9a7a2c0749f5d1e8d0599af24b56624a2128c74ef10.exe.bat
Size 274B
SHA256 67b9fbd6cb04a4580bc96874b135f03c1ed2cf0ec017b40aa79d48e1ce4c8152
MD5 277f15837a8cec6fc4f4d095c42f1278
SHA1 19c4004bfb19dafa5498767d151f2babecf5d041
SHA512 d168004077fa048514f219ca4b72c348e3b11d0026f134dbb3f937175754afe9698234381e2ccd0a7ed8ce92041036b199aa0836ea5629c94238e61f90fbfb11
TLSH
T112D0C210C051853B3C08E54F82B95F4A7151699F328A7B201232C1A4904702CEDB2600
MD5 SHA1 SHA512 TLSH

Submit Download

zesttnsk.exe

Path C:\Windows\SysWOW64\zesttnsk.exe
Size 48KB
SHA256 f4a5fd3d4daf5726e8bef9a7a2c0749f5d1e8d0599af24b56624a2128c74ef10
MD5 8832e6fcea88b042b2cd2ff53e767c91
SHA1 48887e8377400aa0ab3743bd22c2d42552859b09
SHA512 b7538b12aa871781db8acfec7cdac026153319aac5b000f7b924015e9796d04227a8bef49edfd8e1c7d16eb78d65b33e3f349b36cbb85e2f2c37c47c8bb4bf7c
SSDEEP 384:pijoiEa+tvYSi4unIGAj7iQefC7TqIm/q7crN2:oEijmYSuJA6QefC7Ta/qyN2
TLSH
T1AE235CCF994220F1C5EE053032E579176EBA8E3826DC10B7DFA75894BF7508B6198E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download