1568f9aabf5837bb49591dce22e64bc0e8023d89cbff651a4285bb38d1783795

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_1568f9aabf5837bb49591dce22e64bc0e8023d89cbff651a4285bb38d1783795.exe
Size 52KB
Sample260924-mskvyssfnd
SHA256 1568f9aabf5837bb49591dce22e64bc0e8023d89cbff651a4285bb38d1783795
MD5 3e45c6bc89a2b4f8060ae4edc4db67da
SHA1 a86444d0246d1cd1f2ec4e23afcc614c1eb2e0a3
SHA512 524ae1d08cb401660e02b74f26a32accd164eae659271587c5c55685d26deaf4ce9782b091d89d1b50e5d005ebffc8f7badc567d6ff2f232f77476b24cb74f4a
SSDEEP 384:uFwPSSNFyEVR8KvTFKkCKtjsakq4WQYCKT+5KAsT5tB4oCT3GbieDv:7PSOTFKkCBakq4WQYCb5cT5tL43Re
TLSH
T1B6334B8B1A6678B3C2DA413435DDB8661D7E4E3420571C8BEAAFA79D28F8103D129C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4268	mirwzntk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mirwznt.dll	jaffacakes118_1568f9aabf5837bb49591dce22e64bc0e8023d89cbff651a4285bb38d1783795.exe
File created	C:\Windows\SysWOW64\mirwzntk.exe	jaffacakes118_1568f9aabf5837bb49591dce22e64bc0e8023d89cbff651a4285bb38d1783795.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4748	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_1568f9aabf5837bb49591dce22e64bc0e8023d89cbff651a4285bb38d1783795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mirwzntk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 4268	4668	jaffacakes118_1568f9aabf5837bb49591dce22e64bc0e8023d89cbff651a4285bb38d1783795.exe	89
PID 4668 wrote to memory of 4748	4668	jaffacakes118_1568f9aabf5837bb49591dce22e64bc0e8023d89cbff651a4285bb38d1783795.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1568f9aabf5837bb49591dce22e64bc0e8023d89cbff651a4285bb38d1783795.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1568f9aabf5837bb49591dce22e64bc0e8023d89cbff651a4285bb38d1783795.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\SysWOW64\mirwzntk.exe
  C:\Windows\system32\mirwzntk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1568f9aabf5837bb49591dce22e64bc0e8023d89cbff651a4285bb38d1783795.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_1568f9aabf5837bb49591dce22e64bc0e8023d89cbff651a4285bb38d1783795.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1568f9aabf5837bb49591dce22e64bc0e8023d89cbff651a4285bb38d1783795.exe.bat
Size 274B
SHA256 cdd8419a4295890dcec645ff9d090c11daaa38b8901198ca082a27579db4ed4a
MD5 38c6bd324c109d1244727ff247ebd7ed
SHA1 1432cee525d4d8d0e46c04c1695af2fab14df2a6
SHA512 9773576542383b77f73e816c911dae0e24e1f6b599ba2129f2ec197fe23a56bc4b9c8b62af49a145535bd65a6e36d207da25947af9f6c380f20a11489ba2a199
TLSH
T11CD02B116156F00D9C5CB83F103CE248C14355603BEEFB120B634088275382C7BD3B45
MD5 SHA1 SHA512 TLSH

Submit Download

mirwzntk.exe

Path C:\Windows\SysWOW64\mirwzntk.exe
Size 52KB
SHA256 1568f9aabf5837bb49591dce22e64bc0e8023d89cbff651a4285bb38d1783795
MD5 3e45c6bc89a2b4f8060ae4edc4db67da
SHA1 a86444d0246d1cd1f2ec4e23afcc614c1eb2e0a3
SHA512 524ae1d08cb401660e02b74f26a32accd164eae659271587c5c55685d26deaf4ce9782b091d89d1b50e5d005ebffc8f7badc567d6ff2f232f77476b24cb74f4a
SSDEEP 384:uFwPSSNFyEVR8KvTFKkCKtjsakq4WQYCKT+5KAsT5tB4oCT3GbieDv:7PSOTFKkCBakq4WQYCb5cT5tL43Re
TLSH
T1B6334B8B1A6678B3C2DA413435DDB8661D7E4E3420571C8BEAAFA79D28F8103D129C0B
MD5 SHA1 SHA512 SSDEEP TLSH