f77d9e47f2a2cd09ec32f8397cb5e7afda74a1b3abe61806be0f0c9d68f1c55c

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_f77d9e47f2a2cd09ec32f8397cb5e7afda74a1b3abe61806be0f0c9d68f1c55c.exe
Size 52KB
Sample260924-fx7rysef82
SHA256 f77d9e47f2a2cd09ec32f8397cb5e7afda74a1b3abe61806be0f0c9d68f1c55c
MD5 bbff4977365b62e37cf11cfc41238e33
SHA1 6a28d66219750fe409c0b0cd26adfd1c659c4c4e
SHA512 bb6b70f677d1e687f547a6fafce6b1eb30f4c8462a1cee3457f087143d68f56fa2c99d54e38aa5aa15c465d5f212749a2d3fe506c21924b5cd96ba0dcc96c437
SSDEEP 768:IPzJTFqMHMfLXXlLXXlsbSzeWkblV+8NHJ:ILJUM0R+eiDH
TLSH
T1C7332A8F7150EDB2CA2B80366BD5EA6B48B93D3424C2D867FAA1374D187801793C8F57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
3732	craoek.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\craoe.dll	jaffacakes118_f77d9e47f2a2cd09ec32f8397cb5e7afda74a1b3abe61806be0f0c9d68f1c55c.exe
File created	C:\Windows\SysWOW64\craoek.exe	jaffacakes118_f77d9e47f2a2cd09ec32f8397cb5e7afda74a1b3abe61806be0f0c9d68f1c55c.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4160	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_f77d9e47f2a2cd09ec32f8397cb5e7afda74a1b3abe61806be0f0c9d68f1c55c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	craoek.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 3732	4956	jaffacakes118_f77d9e47f2a2cd09ec32f8397cb5e7afda74a1b3abe61806be0f0c9d68f1c55c.exe	89
PID 4956 wrote to memory of 4160	4956	jaffacakes118_f77d9e47f2a2cd09ec32f8397cb5e7afda74a1b3abe61806be0f0c9d68f1c55c.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f77d9e47f2a2cd09ec32f8397cb5e7afda74a1b3abe61806be0f0c9d68f1c55c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f77d9e47f2a2cd09ec32f8397cb5e7afda74a1b3abe61806be0f0c9d68f1c55c.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\craoek.exe
  C:\Windows\system32\craoek.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f77d9e47f2a2cd09ec32f8397cb5e7afda74a1b3abe61806be0f0c9d68f1c55c.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_f77d9e47f2a2cd09ec32f8397cb5e7afda74a1b3abe61806be0f0c9d68f1c55c.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f77d9e47f2a2cd09ec32f8397cb5e7afda74a1b3abe61806be0f0c9d68f1c55c.exe.bat
Size 274B
SHA256 b0130d8d163fdb6bfda69f338138a5145799a389287df89dd37398cd8a5b00eb
MD5 bf0f469b1304745ae7dae4feb7bed2db
SHA1 fba2bc21c057c0ad4fde14f114a432bd268a629b
SHA512 3eb7e92a3b84c5e73c8b16a0ddffe30a21f8da787dd69b5f7e9d9e1f769b130b140020483095a41b959b7c1b29b733b7f6dc4888f02e7595f691f25b98beff10
TLSH
T1E8D02B840872894A4A10EC1F027D1A9DA0450F552BF91E500E3085C5144202DBDC1A0E
MD5 SHA1 SHA512 TLSH

Submit Download

craoek.exe

Path C:\Windows\SysWOW64\craoek.exe
Size 52KB
SHA256 f77d9e47f2a2cd09ec32f8397cb5e7afda74a1b3abe61806be0f0c9d68f1c55c
MD5 bbff4977365b62e37cf11cfc41238e33
SHA1 6a28d66219750fe409c0b0cd26adfd1c659c4c4e
SHA512 bb6b70f677d1e687f547a6fafce6b1eb30f4c8462a1cee3457f087143d68f56fa2c99d54e38aa5aa15c465d5f212749a2d3fe506c21924b5cd96ba0dcc96c437
SSDEEP 768:IPzJTFqMHMfLXXlLXXlsbSzeWkblV+8NHJ:ILJUM0R+eiDH
TLSH
T1C7332A8F7150EDB2CA2B80366BD5EA6B48B93D3424C2D867FAA1374D187801793C8F57
MD5 SHA1 SHA512 SSDEEP TLSH