fd3454009d59af12b2fa754ecea309e940e798a3349456c1c3daa654458978f4

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_fd3454009d59af12b2fa754ecea309e940e798a3349456c1c3daa654458978f4.exe
Size 48KB
Sample260925-2b6tesyw8k
SHA256 fd3454009d59af12b2fa754ecea309e940e798a3349456c1c3daa654458978f4
MD5 203a3d8866b13e820af909048d50187a
SHA1 8006b18cf349db03c5f7ab8469335088c4e727d2
SHA512 ff9e2c3a3cf4c0ee3f3ed063490d2270901be50388d55e2047d69765c730b2b4553b2fa1db20b263691dfd08785a13fdd6db0577242bd2d7160d60cbdc38fb05
SSDEEP 768:txHxqFL6DfrLhN5JlZ2ac99X5mat5FHfnr:txHQJCrtJ1q9Xh3Hfr
TLSH
T1C1236D8B94166CF3CADE043431BF6B231B799D38CAA584E3E7E3558A9D3044BD524D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
1872	kodensk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kodens.dll	jaffacakes118_fd3454009d59af12b2fa754ecea309e940e798a3349456c1c3daa654458978f4.exe
File created	C:\Windows\SysWOW64\kodensk.exe	jaffacakes118_fd3454009d59af12b2fa754ecea309e940e798a3349456c1c3daa654458978f4.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5532	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kodensk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_fd3454009d59af12b2fa754ecea309e940e798a3349456c1c3daa654458978f4.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 1872	4188	jaffacakes118_fd3454009d59af12b2fa754ecea309e940e798a3349456c1c3daa654458978f4.exe	89
PID 4188 wrote to memory of 5532	4188	jaffacakes118_fd3454009d59af12b2fa754ecea309e940e798a3349456c1c3daa654458978f4.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fd3454009d59af12b2fa754ecea309e940e798a3349456c1c3daa654458978f4.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fd3454009d59af12b2fa754ecea309e940e798a3349456c1c3daa654458978f4.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\kodensk.exe
  C:\Windows\system32\kodensk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fd3454009d59af12b2fa754ecea309e940e798a3349456c1c3daa654458978f4.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_fd3454009d59af12b2fa754ecea309e940e798a3349456c1c3daa654458978f4.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fd3454009d59af12b2fa754ecea309e940e798a3349456c1c3daa654458978f4.exe.bat
Size 274B
SHA256 2f067c26697dcbbe641e6ee4cb5e69f7796395370b0bb9b0a86e39c7e3547463
MD5 da0ff5a9ceb16eca5629e204fa006d84
SHA1 abb707678f913ae98437f1fb86f6ea5f967c2894
SHA512 0bbfcb1dbc1b512b3535adbf4b494b4f0883dd09a6bd1507a911ae76b5677ceb86f1a730d542d0fee308b359adcd187ba8d310d5308212d6d5a611327492f64e
TLSH
T1B1D0C200E15B8EC51C80D39B51792F4F40B8CAAC2EC92B010931C6FD12178CFA2E9644
MD5 SHA1 SHA512 TLSH

Submit Download

kodensk.exe

Path C:\Windows\SysWOW64\kodensk.exe
Size 48KB
SHA256 fd3454009d59af12b2fa754ecea309e940e798a3349456c1c3daa654458978f4
MD5 203a3d8866b13e820af909048d50187a
SHA1 8006b18cf349db03c5f7ab8469335088c4e727d2
SHA512 ff9e2c3a3cf4c0ee3f3ed063490d2270901be50388d55e2047d69765c730b2b4553b2fa1db20b263691dfd08785a13fdd6db0577242bd2d7160d60cbdc38fb05
SSDEEP 768:txHxqFL6DfrLhN5JlZ2ac99X5mat5FHfnr:txHQJCrtJ1q9Xh3Hfr
TLSH
T1C1236D8B94166CF3CADE043431BF6B231B799D38CAA584E3E7E3558A9D3044BD524D1B
MD5 SHA1 SHA512 SSDEEP TLSH