43756342a09089d9ebf1a0dd6ad69e0ede4e650788dbf3d95ff1d389cee26cbc

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_43756342a09089d9ebf1a0dd6ad69e0ede4e650788dbf3d95ff1d389cee26cbc.exe
Size 44KB
Sample260930-l9d83awvbx
SHA256 43756342a09089d9ebf1a0dd6ad69e0ede4e650788dbf3d95ff1d389cee26cbc
MD5 38aee4c05b4c8a1c439cf8d6bec8df94
SHA1 61fd922400e8a78ca84c61faddb9d41d8c8347e7
SHA512 783e2d82ea46cb8f4de178f33a606139675feab6989fdbd9e3ed3c14de3bb534878ec282f173f45eb10963c7c475caac5228a1fe41eb7e813547b1c0b3b30a76
SSDEEP 384:noww0KqvWFoGIorhdJ5N9XL3eynN0X5OMRSFIe8SIccCSl:ov/uWFochdJ5N9XL3pN0X5nUIeJI9C
TLSH
T1D1134C8BB6205CB3C5E54034258B5A365BAB6934536BCEC3CF2399C06B74AE14C38B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4704	mduaeyk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mduaey.dll	jaffacakes118_43756342a09089d9ebf1a0dd6ad69e0ede4e650788dbf3d95ff1d389cee26cbc.exe
File created	C:\Windows\SysWOW64\mduaeyk.exe	jaffacakes118_43756342a09089d9ebf1a0dd6ad69e0ede4e650788dbf3d95ff1d389cee26cbc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4540	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_43756342a09089d9ebf1a0dd6ad69e0ede4e650788dbf3d95ff1d389cee26cbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mduaeyk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 4704	2900	jaffacakes118_43756342a09089d9ebf1a0dd6ad69e0ede4e650788dbf3d95ff1d389cee26cbc.exe	88
PID 2900 wrote to memory of 4540	2900	jaffacakes118_43756342a09089d9ebf1a0dd6ad69e0ede4e650788dbf3d95ff1d389cee26cbc.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_43756342a09089d9ebf1a0dd6ad69e0ede4e650788dbf3d95ff1d389cee26cbc.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_43756342a09089d9ebf1a0dd6ad69e0ede4e650788dbf3d95ff1d389cee26cbc.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\mduaeyk.exe
  C:\Windows\system32\mduaeyk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_43756342a09089d9ebf1a0dd6ad69e0ede4e650788dbf3d95ff1d389cee26cbc.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_43756342a09089d9ebf1a0dd6ad69e0ede4e650788dbf3d95ff1d389cee26cbc.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_43756342a09089d9ebf1a0dd6ad69e0ede4e650788dbf3d95ff1d389cee26cbc.exe.bat
Size 274B
SHA256 1d6174fb3dcd1edc124e1d6ce1f718fbc53b391f8ddd0283d7ceee87886b1daf
MD5 5ff2468796a213de97121bc95812135b
SHA1 76b4435d7acd85295ed3b1ee25c642fe6440927b
SHA512 578d8c681dcaed4b78381e84420de171ca46baff28f6bfb13d015864793bb8661c99b4e4af86016548112bb865145aaf2355d3f8695cbdca0f548e500a52bc68
TLSH
T176D02B8071478206DC50E80F4634774C81608D4C7FCE2F216537A2DE613240973C2B98
MD5 SHA1 SHA512 TLSH

Submit Download

mduaeyk.exe

Path C:\Windows\SysWOW64\mduaeyk.exe
Size 44KB
SHA256 43756342a09089d9ebf1a0dd6ad69e0ede4e650788dbf3d95ff1d389cee26cbc
MD5 38aee4c05b4c8a1c439cf8d6bec8df94
SHA1 61fd922400e8a78ca84c61faddb9d41d8c8347e7
SHA512 783e2d82ea46cb8f4de178f33a606139675feab6989fdbd9e3ed3c14de3bb534878ec282f173f45eb10963c7c475caac5228a1fe41eb7e813547b1c0b3b30a76
SSDEEP 384:noww0KqvWFoGIorhdJ5N9XL3eynN0X5OMRSFIe8SIccCSl:ov/uWFochdJ5N9XL3pN0X5nUIeJI9C
TLSH
T1D1134C8BB6205CB3C5E54034258B5A365BAB6934536BCEC3CF2399C06B74AE14C38B0F
MD5 SHA1 SHA512 SSDEEP TLSH