6ac18550ca4c40de1f949dd84e68350b927b10e51900065f38a53b9f8304a891

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_6ac18550ca4c40de1f949dd84e68350b927b10e51900065f38a53b9f8304a891.exe
Size 44KB
Sample260924-m91bzacb65
SHA256 6ac18550ca4c40de1f949dd84e68350b927b10e51900065f38a53b9f8304a891
MD5 86156ecc24124a310660490459724b22
SHA1 8528869470030b8f11c1c8825bcd871f20f93298
SHA512 b244f11d636c6ddb48fa891fe8d79d1d805d4b6543e41ebc852b9672ec338cf91d26968969676a2988cbed0906890b136f000964eaf6280fdb59949f43200206
SSDEEP 384:Im8i1payBBvrtAaqFVsAD2qmvIWWCP6f1Aypct5X5In:ImIyrrtXqQtqmvIWWCP6f13at5XO
TLSH
T1DA135C8B5B0188B2D39B013139CA25366BE79D3017679DD7DF733E8568B01D46E39607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
1076	comboausk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\comboaus.dll	jaffacakes118_6ac18550ca4c40de1f949dd84e68350b927b10e51900065f38a53b9f8304a891.exe
File created	C:\Windows\SysWOW64\comboausk.exe	jaffacakes118_6ac18550ca4c40de1f949dd84e68350b927b10e51900065f38a53b9f8304a891.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3832	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_6ac18550ca4c40de1f949dd84e68350b927b10e51900065f38a53b9f8304a891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	comboausk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3908	jaffacakes118_6ac18550ca4c40de1f949dd84e68350b927b10e51900065f38a53b9f8304a891.exe
3908	jaffacakes118_6ac18550ca4c40de1f949dd84e68350b927b10e51900065f38a53b9f8304a891.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 1076	3908	jaffacakes118_6ac18550ca4c40de1f949dd84e68350b927b10e51900065f38a53b9f8304a891.exe	89
PID 3908 wrote to memory of 3832	3908	jaffacakes118_6ac18550ca4c40de1f949dd84e68350b927b10e51900065f38a53b9f8304a891.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6ac18550ca4c40de1f949dd84e68350b927b10e51900065f38a53b9f8304a891.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6ac18550ca4c40de1f949dd84e68350b927b10e51900065f38a53b9f8304a891.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\comboausk.exe
  C:\Windows\system32\comboausk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6ac18550ca4c40de1f949dd84e68350b927b10e51900065f38a53b9f8304a891.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_6ac18550ca4c40de1f949dd84e68350b927b10e51900065f38a53b9f8304a891.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6ac18550ca4c40de1f949dd84e68350b927b10e51900065f38a53b9f8304a891.exe.bat
Size 274B
SHA256 c899c933bf0216233145d4e78a1d7aac0dc5b80bc777afd6f2c333c71fe1932f
MD5 909a86297556b761466585289ed910fe
SHA1 7fe4ec9656be497a13882b3bdd187d3a151c4fcd
SHA512 5ed0a2788924ba93bb12a48139cef63a32f5b38d5589fde8f2fcb7d9846538805a9a343b04d0867ac39295b7244781173b2052b150ff972d5da6bcb9e00c0e35
TLSH
T19BD02B5041B584895C80D46F0570035ED2357D141FA45F4A5B1083D0A531038F593604
MD5 SHA1 SHA512 TLSH

Submit Download

comboausk.exe

Path C:\Windows\SysWOW64\comboausk.exe
Size 44KB
SHA256 6ac18550ca4c40de1f949dd84e68350b927b10e51900065f38a53b9f8304a891
MD5 86156ecc24124a310660490459724b22
SHA1 8528869470030b8f11c1c8825bcd871f20f93298
SHA512 b244f11d636c6ddb48fa891fe8d79d1d805d4b6543e41ebc852b9672ec338cf91d26968969676a2988cbed0906890b136f000964eaf6280fdb59949f43200206
SSDEEP 384:Im8i1payBBvrtAaqFVsAD2qmvIWWCP6f1Aypct5X5In:ImIyrrtXqQtqmvIWWCP6f13at5XO
TLSH
T1DA135C8B5B0188B2D39B013139CA25366BE79D3017679DD7DF733E8568B01D46E39607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download