2de9d295f56ceced521d2f9892a8c4b51608b5e24f5135cef3217e0936c1282b

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_2de9d295f56ceced521d2f9892a8c4b51608b5e24f5135cef3217e0936c1282b.exe
Size 48KB
Sample260924-m45phasgme
SHA256 2de9d295f56ceced521d2f9892a8c4b51608b5e24f5135cef3217e0936c1282b
MD5 649d745181086e09864352d231f0440f
SHA1 081e5592a1ed72cd7fb660da3b260d6d76b4afeb
SHA512 44735bbbedbe73f9fff741c9e4b28c92abfb5ac2a47456d2101019ee24812bedb9e9660048214b3d91a63cbed18b9a4213b45061b1e3caa741d2e6a8e90b4692
SSDEEP 768:bau8oqFlIiKE6ho5Uh1TVTzy2n+TMxknP4pp4gt0:bH8VCEnUNCngug
TLSH
T144235B4F220089F2C79E857178975B1B6ABF9D342295A4E7DEB354881F3899F38A0D07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
3148	kandofttk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kandoftt.dll	jaffacakes118_2de9d295f56ceced521d2f9892a8c4b51608b5e24f5135cef3217e0936c1282b.exe
File created	C:\Windows\SysWOW64\kandofttk.exe	jaffacakes118_2de9d295f56ceced521d2f9892a8c4b51608b5e24f5135cef3217e0936c1282b.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3840	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_2de9d295f56ceced521d2f9892a8c4b51608b5e24f5135cef3217e0936c1282b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kandofttk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 3148	3424	jaffacakes118_2de9d295f56ceced521d2f9892a8c4b51608b5e24f5135cef3217e0936c1282b.exe	90
PID 3424 wrote to memory of 3840	3424	jaffacakes118_2de9d295f56ceced521d2f9892a8c4b51608b5e24f5135cef3217e0936c1282b.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2de9d295f56ceced521d2f9892a8c4b51608b5e24f5135cef3217e0936c1282b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2de9d295f56ceced521d2f9892a8c4b51608b5e24f5135cef3217e0936c1282b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\SysWOW64\kandofttk.exe
  C:\Windows\system32\kandofttk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2de9d295f56ceced521d2f9892a8c4b51608b5e24f5135cef3217e0936c1282b.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_2de9d295f56ceced521d2f9892a8c4b51608b5e24f5135cef3217e0936c1282b.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2de9d295f56ceced521d2f9892a8c4b51608b5e24f5135cef3217e0936c1282b.exe.bat
Size 274B
SHA256 be8d48a7b628a4dcb34643d612722485395c993f53c3d5ed7bc07c3268bb50f5
MD5 2fdac96dd84fd721e5d528fbbc462e2b
SHA1 45c9e9f01954ce4ddb66e5ef5a378eea070bdb04
SHA512 c9f550d851bf976d81fbd4752a809b006330b239b9e6ab9848a79509e6390a58806cbc2c0de1a088dc7efcd60b24790a20c819f85b915d6845bf16eed755b26e
TLSH
T1DED02B22D156CB6B1C08E63FCFB8056AF0508D5511483F10412580C82163029F5C6E44
MD5 SHA1 SHA512 TLSH

Submit Download

kandofttk.exe

Path C:\Windows\SysWOW64\kandofttk.exe
Size 48KB
SHA256 2de9d295f56ceced521d2f9892a8c4b51608b5e24f5135cef3217e0936c1282b
MD5 649d745181086e09864352d231f0440f
SHA1 081e5592a1ed72cd7fb660da3b260d6d76b4afeb
SHA512 44735bbbedbe73f9fff741c9e4b28c92abfb5ac2a47456d2101019ee24812bedb9e9660048214b3d91a63cbed18b9a4213b45061b1e3caa741d2e6a8e90b4692
SSDEEP 768:bau8oqFlIiKE6ho5Uh1TVTzy2n+TMxknP4pp4gt0:bH8VCEnUNCngug
TLSH
T144235B4F220089F2C79E857178975B1B6ABF9D342295A4E7DEB354881F3899F38A0D07
MD5 SHA1 SHA512 SSDEEP TLSH