f2ab25a3aff2b1979e1e1b326ffb1d38a4ccc7107b93607c9490f7fcb0710d16

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_f2ab25a3aff2b1979e1e1b326ffb1d38a4ccc7107b93607c9490f7fcb0710d16.exe
Size 48KB
Sample260925-2c3hds1tes
SHA256 f2ab25a3aff2b1979e1e1b326ffb1d38a4ccc7107b93607c9490f7fcb0710d16
MD5 596ac4ec848f58fefc6786d85d1f51d7
SHA1 b41db66a02287979bc802fbfb5dadfc18cc95cec
SHA512 06d8576f05c839dde450c2c413af6c4a1e9dc56c76a45d44f701ee0c59be26a6edb05bbf213aef7a0fad528326145987f80643e91c6f78136da889c997bc7cc7
SSDEEP 768:kDR44qFiBRRo7pVoJwuGTLTBwuT/DhKt4tNu:kV4F8BRa7boJSDwq7
TLSH
T18223398F22009AB2CA99857538A7672B6ABF4D31027564E7DF73198C1F3C58F39A0D07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4260	kandofttk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kandoftt.dll	jaffacakes118_f2ab25a3aff2b1979e1e1b326ffb1d38a4ccc7107b93607c9490f7fcb0710d16.exe
File created	C:\Windows\SysWOW64\kandofttk.exe	jaffacakes118_f2ab25a3aff2b1979e1e1b326ffb1d38a4ccc7107b93607c9490f7fcb0710d16.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_f2ab25a3aff2b1979e1e1b326ffb1d38a4ccc7107b93607c9490f7fcb0710d16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kandofttk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 4260	1696	jaffacakes118_f2ab25a3aff2b1979e1e1b326ffb1d38a4ccc7107b93607c9490f7fcb0710d16.exe	89
PID 1696 wrote to memory of 5928	1696	jaffacakes118_f2ab25a3aff2b1979e1e1b326ffb1d38a4ccc7107b93607c9490f7fcb0710d16.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f2ab25a3aff2b1979e1e1b326ffb1d38a4ccc7107b93607c9490f7fcb0710d16.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f2ab25a3aff2b1979e1e1b326ffb1d38a4ccc7107b93607c9490f7fcb0710d16.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\kandofttk.exe
  C:\Windows\system32\kandofttk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f2ab25a3aff2b1979e1e1b326ffb1d38a4ccc7107b93607c9490f7fcb0710d16.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_f2ab25a3aff2b1979e1e1b326ffb1d38a4ccc7107b93607c9490f7fcb0710d16.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f2ab25a3aff2b1979e1e1b326ffb1d38a4ccc7107b93607c9490f7fcb0710d16.exe.bat
Size 274B
SHA256 72ebbb8b54fab267df1ab30b9c9813f39666dae739bb7e30469d5a209583bfa5
MD5 b326cb2f4af23e1418fd45eaeb3c2d3f
SHA1 2b008cec8e847c05f0c78bdda97c1d79bbfda025
SHA512 78c3bf50b5890dbe6e585113228d20996b4971258457ab0c668c258f4b2a49a650b6b383d2b6358121f445604b3091768b0cdc5d95c9e45e568fc06a90d8a672
TLSH
T1DDD02B30B6138123DC58849F037D67547018DDEC3FD82F61132181D55171704E993B94
MD5 SHA1 SHA512 TLSH

Submit Download

kandofttk.exe

Path C:\Windows\SysWOW64\kandofttk.exe
Size 48KB
SHA256 f2ab25a3aff2b1979e1e1b326ffb1d38a4ccc7107b93607c9490f7fcb0710d16
MD5 596ac4ec848f58fefc6786d85d1f51d7
SHA1 b41db66a02287979bc802fbfb5dadfc18cc95cec
SHA512 06d8576f05c839dde450c2c413af6c4a1e9dc56c76a45d44f701ee0c59be26a6edb05bbf213aef7a0fad528326145987f80643e91c6f78136da889c997bc7cc7
SSDEEP 768:kDR44qFiBRRo7pVoJwuGTLTBwuT/DhKt4tNu:kV4F8BRa7boJSDwq7
TLSH
T18223398F22009AB2CA99857538A7672B6ABF4D31027564E7DF73198C1F3C58F39A0D07
MD5 SHA1 SHA512 SSDEEP TLSH