25f05ad8ca8c9a0f0df59ad45d6eb9dd90f74c4e998ef6880daaac1becd0dcf6

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_25f05ad8ca8c9a0f0df59ad45d6eb9dd90f74c4e998ef6880daaac1becd0dcf6.exe
Size 48KB
Sample260925-2dzswsyamd
SHA256 25f05ad8ca8c9a0f0df59ad45d6eb9dd90f74c4e998ef6880daaac1becd0dcf6
MD5 ff7a0195ec635050bb24af54b4a6f541
SHA1 82d33966879e4575ceda0d5b19e9d12ec26d719c
SHA512 083d56c073bd67d94b6e15f4c54b619a31b373bd20079d10fcfda5879d7a4ebb5a46887258793e0d53944ed71d920ea65f3d12b60d05ce49afbfcd0db35ae6b7
SSDEEP 768:KXtiIIqF8Acixb26gqtTPTnw0MTctciWL3:KcI1efiA6g+wSShL3
TLSH
T1E023394F82009AF3DA8C06B57987675B6BBE5D38177850A7D3B729CC0C7988B45E4E07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4644	fliecodsk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fliecods.dll	jaffacakes118_25f05ad8ca8c9a0f0df59ad45d6eb9dd90f74c4e998ef6880daaac1becd0dcf6.exe
File created	C:\Windows\SysWOW64\fliecodsk.exe	jaffacakes118_25f05ad8ca8c9a0f0df59ad45d6eb9dd90f74c4e998ef6880daaac1becd0dcf6.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2768	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fliecodsk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_25f05ad8ca8c9a0f0df59ad45d6eb9dd90f74c4e998ef6880daaac1becd0dcf6.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 4644	2728	jaffacakes118_25f05ad8ca8c9a0f0df59ad45d6eb9dd90f74c4e998ef6880daaac1becd0dcf6.exe	89
PID 2728 wrote to memory of 2768	2728	jaffacakes118_25f05ad8ca8c9a0f0df59ad45d6eb9dd90f74c4e998ef6880daaac1becd0dcf6.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_25f05ad8ca8c9a0f0df59ad45d6eb9dd90f74c4e998ef6880daaac1becd0dcf6.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_25f05ad8ca8c9a0f0df59ad45d6eb9dd90f74c4e998ef6880daaac1becd0dcf6.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\fliecodsk.exe
  C:\Windows\system32\fliecodsk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_25f05ad8ca8c9a0f0df59ad45d6eb9dd90f74c4e998ef6880daaac1becd0dcf6.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_25f05ad8ca8c9a0f0df59ad45d6eb9dd90f74c4e998ef6880daaac1becd0dcf6.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_25f05ad8ca8c9a0f0df59ad45d6eb9dd90f74c4e998ef6880daaac1becd0dcf6.exe.bat
Size 274B
SHA256 fb451c8257b06d6c35206f2c26afd06ead2bab9b0cdecec6ff8346b93201264c
MD5 feed9276dc41186f14042bdccad8017b
SHA1 8d6526fa277a0fbcfcb34a4a0999551ac9bd12bf
SHA512 45a6e120c431e86cc28a7707b72f5e557f433f04e5c688e4fa373e0766f4fa6e090c1d82f6ecf8a21acad242f4d26993aadfba55f238dc90cb7d26b832814da2
TLSH
T11CD02B14E0538FB64840A16F0C34A288C114484023441F099235A4AAB32342CF2D1B0B
MD5 SHA1 SHA512 TLSH

Submit Download

fliecodsk.exe

Path C:\Windows\SysWOW64\fliecodsk.exe
Size 48KB
SHA256 25f05ad8ca8c9a0f0df59ad45d6eb9dd90f74c4e998ef6880daaac1becd0dcf6
MD5 ff7a0195ec635050bb24af54b4a6f541
SHA1 82d33966879e4575ceda0d5b19e9d12ec26d719c
SHA512 083d56c073bd67d94b6e15f4c54b619a31b373bd20079d10fcfda5879d7a4ebb5a46887258793e0d53944ed71d920ea65f3d12b60d05ce49afbfcd0db35ae6b7
SSDEEP 768:KXtiIIqF8Acixb26gqtTPTnw0MTctciWL3:KcI1efiA6g+wSShL3
TLSH
T1E023394F82009AF3DA8C06B57987675B6BBE5D38177850A7D3B729CC0C7988B45E4E07
MD5 SHA1 SHA512 SSDEEP TLSH