c47a0678d6b3a74b986096d8053db42d5ac53eedf19fd6f541b535b0aac31483

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_c47a0678d6b3a74b986096d8053db42d5ac53eedf19fd6f541b535b0aac31483.exe
Size 48KB
Sample260925-2e2zmsyane
SHA256 c47a0678d6b3a74b986096d8053db42d5ac53eedf19fd6f541b535b0aac31483
MD5 410ff9669ea988f1664c6582fe47be36
SHA1 7cad721f0156284630f0c011f853a3a6643867a8
SHA512 c05fe11c72b22c42ec372dd05b5b3728c848665ab02c959eb46ad0a1be270e8d408589ca3fb032e301ad8d7ce2ccab606a0fe04f9e772434b73b5bd31aa4f74f
SSDEEP 384:IMyvADekRtvYSFwzn8xOrLgN205ahYLKPXPClP/Yda7+P1F:IrY6knYSG8Mrx0N+PXPClPAdaa7
TLSH
T101235C8B944264F1D5A68A342692661367EE4D3C336464ABDF7348CC7F2E48F72C5E07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
3176	zesttnsk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zesttns.dll	jaffacakes118_c47a0678d6b3a74b986096d8053db42d5ac53eedf19fd6f541b535b0aac31483.exe
File created	C:\Windows\SysWOW64\zesttnsk.exe	jaffacakes118_c47a0678d6b3a74b986096d8053db42d5ac53eedf19fd6f541b535b0aac31483.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3608	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_c47a0678d6b3a74b986096d8053db42d5ac53eedf19fd6f541b535b0aac31483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zesttnsk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1248	jaffacakes118_c47a0678d6b3a74b986096d8053db42d5ac53eedf19fd6f541b535b0aac31483.exe
1248	jaffacakes118_c47a0678d6b3a74b986096d8053db42d5ac53eedf19fd6f541b535b0aac31483.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 3176	1248	jaffacakes118_c47a0678d6b3a74b986096d8053db42d5ac53eedf19fd6f541b535b0aac31483.exe	89
PID 1248 wrote to memory of 3608	1248	jaffacakes118_c47a0678d6b3a74b986096d8053db42d5ac53eedf19fd6f541b535b0aac31483.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c47a0678d6b3a74b986096d8053db42d5ac53eedf19fd6f541b535b0aac31483.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c47a0678d6b3a74b986096d8053db42d5ac53eedf19fd6f541b535b0aac31483.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\SysWOW64\zesttnsk.exe
  C:\Windows\system32\zesttnsk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c47a0678d6b3a74b986096d8053db42d5ac53eedf19fd6f541b535b0aac31483.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_c47a0678d6b3a74b986096d8053db42d5ac53eedf19fd6f541b535b0aac31483.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c47a0678d6b3a74b986096d8053db42d5ac53eedf19fd6f541b535b0aac31483.exe.bat
Size 274B
SHA256 c69d1ca036aa830d7d40815bd183acdc4123c6c07638c06759600f567624d8d5
MD5 68315adfb66e4c92c30f1af5dacf7149
SHA1 107bc7fb3adb7ba3b49aefd7c31034b88fd4da19
SHA512 7c02ddc414b2cc191b37febfaa62692667fe1963ce56e72f921fe1346d115b29c6ebfacc229c739410fea92074b7cf7fc7a1970b7f8595752e50e089a2d5f55b
TLSH
T16AD0C26A936B8B06A400D83B876CE90EC0311A6A7ACD2BE00520D6F121E1038EEC1E4E
MD5 SHA1 SHA512 TLSH

Submit Download

zesttnsk.exe

Path C:\Windows\SysWOW64\zesttnsk.exe
Size 48KB
SHA256 c47a0678d6b3a74b986096d8053db42d5ac53eedf19fd6f541b535b0aac31483
MD5 410ff9669ea988f1664c6582fe47be36
SHA1 7cad721f0156284630f0c011f853a3a6643867a8
SHA512 c05fe11c72b22c42ec372dd05b5b3728c848665ab02c959eb46ad0a1be270e8d408589ca3fb032e301ad8d7ce2ccab606a0fe04f9e772434b73b5bd31aa4f74f
SSDEEP 384:IMyvADekRtvYSFwzn8xOrLgN205ahYLKPXPClP/Yda7+P1F:IrY6knYSG8Mrx0N+PXPClPAdaa7
TLSH
T101235C8B944264F1D5A68A342692661367EE4D3C336464ABDF7348CC7F2E48F72C5E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download