975649f1c270072c719a5292d8e0ee36e0cc375902fce338c61aed769d431e98

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_975649f1c270072c719a5292d8e0ee36e0cc375902fce338c61aed769d431e98.exe
Size 48KB
Sample260924-glahrazbja
SHA256 975649f1c270072c719a5292d8e0ee36e0cc375902fce338c61aed769d431e98
MD5 0d4ad82571bd4604214df9d6aa3d0649
SHA1 3ab217215a437c3eabaaed62a33449ea4aa9611c
SHA512 838bc976629e344bd2632fe7fbd6a93d95b4fc358d75bf9ac654a29c957f95c80adb5a026b1db14f9c33ca69832c722a98ee372a1222b101f7aa1344e6d34acd
SSDEEP 384:Is3FjsWDsbNodvYSU0HFnc6irjeXH8y4PmPqhP9TZKoK7tJk:IKjliQYSUEFtif+4PmPqhP917KZe
TLSH
T15D234D8F650254B1D1EAC8752291690366EF8D38369864ABDF338DC47BB948F71D4E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
3212	zesttnsk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zesttns.dll	jaffacakes118_975649f1c270072c719a5292d8e0ee36e0cc375902fce338c61aed769d431e98.exe
File created	C:\Windows\SysWOW64\zesttnsk.exe	jaffacakes118_975649f1c270072c719a5292d8e0ee36e0cc375902fce338c61aed769d431e98.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2660	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_975649f1c270072c719a5292d8e0ee36e0cc375902fce338c61aed769d431e98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zesttnsk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2992	jaffacakes118_975649f1c270072c719a5292d8e0ee36e0cc375902fce338c61aed769d431e98.exe
2992	jaffacakes118_975649f1c270072c719a5292d8e0ee36e0cc375902fce338c61aed769d431e98.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3212	2992	jaffacakes118_975649f1c270072c719a5292d8e0ee36e0cc375902fce338c61aed769d431e98.exe	89
PID 2992 wrote to memory of 2660	2992	jaffacakes118_975649f1c270072c719a5292d8e0ee36e0cc375902fce338c61aed769d431e98.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_975649f1c270072c719a5292d8e0ee36e0cc375902fce338c61aed769d431e98.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_975649f1c270072c719a5292d8e0ee36e0cc375902fce338c61aed769d431e98.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\zesttnsk.exe
  C:\Windows\system32\zesttnsk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_975649f1c270072c719a5292d8e0ee36e0cc375902fce338c61aed769d431e98.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_975649f1c270072c719a5292d8e0ee36e0cc375902fce338c61aed769d431e98.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_975649f1c270072c719a5292d8e0ee36e0cc375902fce338c61aed769d431e98.exe.bat
Size 274B
SHA256 b903ae6d530392740c6188178ddeb133b4e6438ec258b919290b94cef63135ad
MD5 1d9712fbe1df8536cd793dfb56c683f4
SHA1 2ea7731461fed37d84cf29e7c385ecaad8bb97ea
SHA512 c0ed2aef7f7c0d6f8d204dafb26eb66887e5d842018d87084e19608e302f038b6f5c51d9db12c9782e01061dee855ec487900f7a1237afe0dfe794e3066ddd21
TLSH
T16FD0C2564533EE253C0088AB82342A0FC37A29AF368C3F200721CC8B223007DF1E2700
MD5 SHA1 SHA512 TLSH

Submit Download

zesttnsk.exe

Path C:\Windows\SysWOW64\zesttnsk.exe
Size 48KB
SHA256 975649f1c270072c719a5292d8e0ee36e0cc375902fce338c61aed769d431e98
MD5 0d4ad82571bd4604214df9d6aa3d0649
SHA1 3ab217215a437c3eabaaed62a33449ea4aa9611c
SHA512 838bc976629e344bd2632fe7fbd6a93d95b4fc358d75bf9ac654a29c957f95c80adb5a026b1db14f9c33ca69832c722a98ee372a1222b101f7aa1344e6d34acd
SSDEEP 384:Is3FjsWDsbNodvYSU0HFnc6irjeXH8y4PmPqhP9TZKoK7tJk:IKjliQYSUEFtif+4PmPqhP917KZe
TLSH
T15D234D8F650254B1D1EAC8752291690366EF8D38369864ABDF338DC47BB948F71D4E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download