ffa8dd199031630574f3067dfc2658ec0cf0b91aa463c76a67f52d8324e86b07

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_ffa8dd199031630574f3067dfc2658ec0cf0b91aa463c76a67f52d8324e86b07.exe
Size 48KB
Sample260925-2f7lhs1vas
SHA256 ffa8dd199031630574f3067dfc2658ec0cf0b91aa463c76a67f52d8324e86b07
MD5 0cf1d1343bf22339698c0f2399853194
SHA1 50bb34bd28eff0df5751772f6b09a27021c9b2ca
SHA512 f42a53876decb9cba1e725472c3865981ab70d843a718683b6837b1a846c82d07fc12a8aae8e0b7d35a5fac90cf9b5874d74bc75088ec01b9fc9a89b4b4d55e2
SSDEEP 384:ZAP4/3NvNgKWQiHfvb6fN9tK5X+moczikUpw1HelYmpct5Tql/U:CP4vlNgKhUfvbuK53rzi0HelTat5Tql
TLSH
T112234B0B65549CF2C39F483432AB7B221FEA5D341626A1D3DBF369D52D319A30A31B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
472	ringttek.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ringtte.dll	jaffacakes118_ffa8dd199031630574f3067dfc2658ec0cf0b91aa463c76a67f52d8324e86b07.exe
File created	C:\Windows\SysWOW64\ringttek.exe	jaffacakes118_ffa8dd199031630574f3067dfc2658ec0cf0b91aa463c76a67f52d8324e86b07.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4548	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ringttek.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_ffa8dd199031630574f3067dfc2658ec0cf0b91aa463c76a67f52d8324e86b07.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 472	5564	jaffacakes118_ffa8dd199031630574f3067dfc2658ec0cf0b91aa463c76a67f52d8324e86b07.exe	88
PID 5564 wrote to memory of 4548	5564	jaffacakes118_ffa8dd199031630574f3067dfc2658ec0cf0b91aa463c76a67f52d8324e86b07.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ffa8dd199031630574f3067dfc2658ec0cf0b91aa463c76a67f52d8324e86b07.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ffa8dd199031630574f3067dfc2658ec0cf0b91aa463c76a67f52d8324e86b07.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Windows\SysWOW64\ringttek.exe
  C:\Windows\system32\ringttek.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ffa8dd199031630574f3067dfc2658ec0cf0b91aa463c76a67f52d8324e86b07.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_ffa8dd199031630574f3067dfc2658ec0cf0b91aa463c76a67f52d8324e86b07.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ffa8dd199031630574f3067dfc2658ec0cf0b91aa463c76a67f52d8324e86b07.exe.bat
Size 274B
SHA256 567bd7ad1dc3c117b2c59d905d5aa936c2254b17f6bc463f8ff3240b7b537e80
MD5 467cd32fd94726e7127c6000786f08bf
SHA1 5a23ef1d43890b1c8a894dc8c9037e35b3dc586a
SHA512 6bd09b0510c2a7a7c46bd706e394808f9101c8c3bc3e8baf853d491b5b22b4e10faaa1303024e7e4f7fb32027a0614e5dc8ee4ce999b7bb256d9664e3371d9da
TLSH
T14AD02BC498C1CAC06804D0BB0325D68442A835AE77C82F19423B83DD2CE140DB9C370B
MD5 SHA1 SHA512 TLSH

Submit Download

ringttek.exe

Path C:\Windows\SysWOW64\ringttek.exe
Size 48KB
SHA256 ffa8dd199031630574f3067dfc2658ec0cf0b91aa463c76a67f52d8324e86b07
MD5 0cf1d1343bf22339698c0f2399853194
SHA1 50bb34bd28eff0df5751772f6b09a27021c9b2ca
SHA512 f42a53876decb9cba1e725472c3865981ab70d843a718683b6837b1a846c82d07fc12a8aae8e0b7d35a5fac90cf9b5874d74bc75088ec01b9fc9a89b4b4d55e2
SSDEEP 384:ZAP4/3NvNgKWQiHfvb6fN9tK5X+moczikUpw1HelYmpct5Tql/U:CP4vlNgKhUfvbuK53rzi0HelTat5Tql
TLSH
T112234B0B65549CF2C39F483432AB7B221FEA5D341626A1D3DBF369D52D319A30A31B0B
MD5 SHA1 SHA512 SSDEEP TLSH