ac1669c63db8a31d2060205eac3a6429893a00126f6e1b432d7f88640a37c42e

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_ac1669c63db8a31d2060205eac3a6429893a00126f6e1b432d7f88640a37c42e.exe
Size 44KB
Sample260925-w5rnpstdnd
SHA256 ac1669c63db8a31d2060205eac3a6429893a00126f6e1b432d7f88640a37c42e
MD5 1e92a2798559edbc637b5a898f35710a
SHA1 70d40c46d7a9fa04fb741866aa4f9890fece4d4b
SHA512 e79fb9044973587c49cc246454ed22ac07a5957cce3425bd8342b41ab13651f4b323b7cfe57436fb5afc10d0f28d819bde9a520c0f1efd8e21df2d26acba2867
SSDEEP 384:Dw7EyoTtHj3iiADbIKXXZyA8v5toMl8j/1E+ipct5YmV+tMdn:07E3TljSVDbVXav4Mmjq5at57+tMdn
TLSH
T130134A8B2B0588F2D1ED407534CA162667FAAC30076B69D3CF3366C5DD302D9AD3A25B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
3124	peuseuk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\peuseu.dll	jaffacakes118_ac1669c63db8a31d2060205eac3a6429893a00126f6e1b432d7f88640a37c42e.exe
File created	C:\Windows\SysWOW64\peuseuk.exe	jaffacakes118_ac1669c63db8a31d2060205eac3a6429893a00126f6e1b432d7f88640a37c42e.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3940	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_ac1669c63db8a31d2060205eac3a6429893a00126f6e1b432d7f88640a37c42e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	peuseuk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4312	jaffacakes118_ac1669c63db8a31d2060205eac3a6429893a00126f6e1b432d7f88640a37c42e.exe
4312	jaffacakes118_ac1669c63db8a31d2060205eac3a6429893a00126f6e1b432d7f88640a37c42e.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 3124	4312	jaffacakes118_ac1669c63db8a31d2060205eac3a6429893a00126f6e1b432d7f88640a37c42e.exe	88
PID 4312 wrote to memory of 3940	4312	jaffacakes118_ac1669c63db8a31d2060205eac3a6429893a00126f6e1b432d7f88640a37c42e.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ac1669c63db8a31d2060205eac3a6429893a00126f6e1b432d7f88640a37c42e.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ac1669c63db8a31d2060205eac3a6429893a00126f6e1b432d7f88640a37c42e.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\peuseuk.exe
  C:\Windows\system32\peuseuk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ac1669c63db8a31d2060205eac3a6429893a00126f6e1b432d7f88640a37c42e.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_ac1669c63db8a31d2060205eac3a6429893a00126f6e1b432d7f88640a37c42e.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ac1669c63db8a31d2060205eac3a6429893a00126f6e1b432d7f88640a37c42e.exe.bat
Size 274B
SHA256 95c99bf65e30b367cf4ea4bfb196f7a4a41c35a8449fa6006e7efd76d1f5f14f
MD5 50f345e2bf7b438e00fabaea62b9cf14
SHA1 fa0a8b73eeb0c8a9cfc0212a9816a5a5f3f74e3b
SHA512 742ce65ec61daaf5fcf8282c7b8f8bce9bba52188633bf12b6f22dd2751491037b6cacd863d012c1a9af634a031d52d0258aae2491cab9810b19fd3ef9c5bbe3
TLSH
T1B7D02B326363EE5EE4E4E51F613A0B4780B14944674E3F918B11E1951260115F6DD349
MD5 SHA1 SHA512 TLSH

Submit Download

peuseuk.exe

Path C:\Windows\SysWOW64\peuseuk.exe
Size 44KB
SHA256 ac1669c63db8a31d2060205eac3a6429893a00126f6e1b432d7f88640a37c42e
MD5 1e92a2798559edbc637b5a898f35710a
SHA1 70d40c46d7a9fa04fb741866aa4f9890fece4d4b
SHA512 e79fb9044973587c49cc246454ed22ac07a5957cce3425bd8342b41ab13651f4b323b7cfe57436fb5afc10d0f28d819bde9a520c0f1efd8e21df2d26acba2867
SSDEEP 384:Dw7EyoTtHj3iiADbIKXXZyA8v5toMl8j/1E+ipct5YmV+tMdn:07E3TljSVDbVXav4Mmjq5at57+tMdn
TLSH
T130134A8B2B0588F2D1ED407534CA162667FAAC30076B69D3CF3366C5DD302D9AD3A25B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download