1a5dd0cf0e23c57cfef2a6c112c93234a0b73d10fd2c092c104a16218dc536f7

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 11:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_1a5dd0cf0e23c57cfef2a6c112c93234a0b73d10fd2c092c104a16218dc536f7.exe
Size 48KB
Sample260924-nj2msacd97
SHA256 1a5dd0cf0e23c57cfef2a6c112c93234a0b73d10fd2c092c104a16218dc536f7
MD5 d8066691dd3a56e4f60827633e864803
SHA1 1b1a5b755ea72a4847b61557ff12036bc11629c8
SHA512 571377f4ccfdbf59af155d276a321521f24167e1194bd88333531e3e93ac568189a234315898128763bc9eef7807ce6c4ae786abe2e4151e32f929f5f1a37c42
SSDEEP 384:eHTXCaIvNg6gM45LS/pVahILhgtyEQf/j9tpct5JBfnKxq:gTXbsNgVMEGBVyIQCjHat5zfnKxq
TLSH
T1F8235D8BE92598B2C795487436DE23330FAA4D315B3664D3DBF316C51C24ED78931A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
3428	micsusk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\micsus.dll	jaffacakes118_1a5dd0cf0e23c57cfef2a6c112c93234a0b73d10fd2c092c104a16218dc536f7.exe
File created	C:\Windows\SysWOW64\micsusk.exe	jaffacakes118_1a5dd0cf0e23c57cfef2a6c112c93234a0b73d10fd2c092c104a16218dc536f7.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3968	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_1a5dd0cf0e23c57cfef2a6c112c93234a0b73d10fd2c092c104a16218dc536f7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	micsusk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 3428	6076	jaffacakes118_1a5dd0cf0e23c57cfef2a6c112c93234a0b73d10fd2c092c104a16218dc536f7.exe	89
PID 6076 wrote to memory of 3968	6076	jaffacakes118_1a5dd0cf0e23c57cfef2a6c112c93234a0b73d10fd2c092c104a16218dc536f7.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1a5dd0cf0e23c57cfef2a6c112c93234a0b73d10fd2c092c104a16218dc536f7.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1a5dd0cf0e23c57cfef2a6c112c93234a0b73d10fd2c092c104a16218dc536f7.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Windows\SysWOW64\micsusk.exe
  C:\Windows\system32\micsusk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1a5dd0cf0e23c57cfef2a6c112c93234a0b73d10fd2c092c104a16218dc536f7.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_1a5dd0cf0e23c57cfef2a6c112c93234a0b73d10fd2c092c104a16218dc536f7.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1a5dd0cf0e23c57cfef2a6c112c93234a0b73d10fd2c092c104a16218dc536f7.exe.bat
Size 274B
SHA256 87bdfdd762da0d265e67da718819fdafe1d9c551adadfa107a6ab22695ab3e73
MD5 ff3108468dc87fa8ebc77b944071b558
SHA1 2ceedf317ca1556045748436ae7beb824646a752
SHA512 f4706199ab7947d13d47a04db4fb532ddd14b64d1409776cb1d54baad3a3f72fccf4242dc7c5cedcc53f0ebc5c0a6a4c55e728569294701c18037ae19d73c08b
TLSH
T1CDD02B6848E6C50D4C00CA1F04655E4F80170ABD32C52F0BCB3158CD233192963D6305
MD5 SHA1 SHA512 TLSH

Submit Download

micsusk.exe

Path C:\Windows\SysWOW64\micsusk.exe
Size 48KB
SHA256 1a5dd0cf0e23c57cfef2a6c112c93234a0b73d10fd2c092c104a16218dc536f7
MD5 d8066691dd3a56e4f60827633e864803
SHA1 1b1a5b755ea72a4847b61557ff12036bc11629c8
SHA512 571377f4ccfdbf59af155d276a321521f24167e1194bd88333531e3e93ac568189a234315898128763bc9eef7807ce6c4ae786abe2e4151e32f929f5f1a37c42
SSDEEP 384:eHTXCaIvNg6gM45LS/pVahILhgtyEQf/j9tpct5JBfnKxq:gTXbsNgVMEGBVyIQCjHat5zfnKxq
TLSH
T1F8235D8BE92598B2C795487436DE23330FAA4D315B3664D3DBF316C51C24ED78931A1B
MD5 SHA1 SHA512 SSDEEP TLSH