04a2b61ca30490630ffc9adca05efb0b91b069e310673f9cc4a258ddb262bf6b

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 05:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_04a2b61ca30490630ffc9adca05efb0b91b069e310673f9cc4a258ddb262bf6b.exe
Size 48KB
Sample260924-gfd9razsdx
SHA256 04a2b61ca30490630ffc9adca05efb0b91b069e310673f9cc4a258ddb262bf6b
MD5 d1001af402b239e0c2f7ed8cfa91ef44
SHA1 ebb8f3a65ef466efec9e56a4f55fa8249f1a0adb
SHA512 eb5963098eda16747d66b705beb0edd58d4a9f42422598329a3f19e9c4637a65112ba7de31199d33274f160861ff5c256b1938bc7e47aacd923b2b25bf24e0f5
SSDEEP 384:EwiIWY9EJ31A9vqF2UQWyOc+YStATEI6/iUYTcTrtl8TmoQL+TDT5hli:ANxF8qF26If6/iUYTcTrtl8T3iyvl
TLSH
T12B23394F120059F3CA9D06B97987A74F6BBE5C35133960A7D3B758CD1C3A48B45A8E07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
3612	fliecodsk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fliecods.dll	jaffacakes118_04a2b61ca30490630ffc9adca05efb0b91b069e310673f9cc4a258ddb262bf6b.exe
File created	C:\Windows\SysWOW64\fliecodsk.exe	jaffacakes118_04a2b61ca30490630ffc9adca05efb0b91b069e310673f9cc4a258ddb262bf6b.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4852	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_04a2b61ca30490630ffc9adca05efb0b91b069e310673f9cc4a258ddb262bf6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fliecodsk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 3612	2856	jaffacakes118_04a2b61ca30490630ffc9adca05efb0b91b069e310673f9cc4a258ddb262bf6b.exe	89
PID 2856 wrote to memory of 4852	2856	jaffacakes118_04a2b61ca30490630ffc9adca05efb0b91b069e310673f9cc4a258ddb262bf6b.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_04a2b61ca30490630ffc9adca05efb0b91b069e310673f9cc4a258ddb262bf6b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_04a2b61ca30490630ffc9adca05efb0b91b069e310673f9cc4a258ddb262bf6b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\fliecodsk.exe
  C:\Windows\system32\fliecodsk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_04a2b61ca30490630ffc9adca05efb0b91b069e310673f9cc4a258ddb262bf6b.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_04a2b61ca30490630ffc9adca05efb0b91b069e310673f9cc4a258ddb262bf6b.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_04a2b61ca30490630ffc9adca05efb0b91b069e310673f9cc4a258ddb262bf6b.exe.bat
Size 274B
SHA256 c23f43d8b15397fa23d13efcfdd9cae749ffdd8df9b6fd722aa75f7306c166be
MD5 7e4f48478499890622a24b620e4dab80
SHA1 87c4e1a5efc5e8538c9aa1d77e3c3ff6b452f2d0
SHA512 2232a647269cc21d1d185dc9d645300487275aa7d45d943910520d9bbe3838bae1569c9954510e37200e70d5a3bfb68e009c57d6dd43e9f41af3828548aa7c4b
TLSH
T149D02B2890F1D33E1C10CC6F1A380FC58090876D2B8F6E318B124ACA2073124FBF1640
MD5 SHA1 SHA512 TLSH

Submit Download

fliecodsk.exe

Path C:\Windows\SysWOW64\fliecodsk.exe
Size 48KB
SHA256 04a2b61ca30490630ffc9adca05efb0b91b069e310673f9cc4a258ddb262bf6b
MD5 d1001af402b239e0c2f7ed8cfa91ef44
SHA1 ebb8f3a65ef466efec9e56a4f55fa8249f1a0adb
SHA512 eb5963098eda16747d66b705beb0edd58d4a9f42422598329a3f19e9c4637a65112ba7de31199d33274f160861ff5c256b1938bc7e47aacd923b2b25bf24e0f5
SSDEEP 384:EwiIWY9EJ31A9vqF2UQWyOc+YStATEI6/iUYTcTrtl8TmoQL+TDT5hli:ANxF8qF26If6/iUYTcTrtl8T3iyvl
TLSH
T12B23394F120059F3CA9D06B97987A74F6BBE5C35133960A7D3B758CD1C3A48B45A8E07
MD5 SHA1 SHA512 SSDEEP TLSH