8e5ef727edf618e90b0feaee86fc6798e64307ba6ba262e0271317b71f5c1472

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_8e5ef727edf618e90b0feaee86fc6798e64307ba6ba262e0271317b71f5c1472.exe
Size 48KB
Sample260924-ft23asef32
SHA256 8e5ef727edf618e90b0feaee86fc6798e64307ba6ba262e0271317b71f5c1472
MD5 f48d0384ce1fd774f93065190e0c60d1
SHA1 efaa7a3057ab61f4cdb2211dc82785897a6c3a1d
SHA512 f5ee7250288eb7ed0db69e9ddf26a8d55aadadedfe92ee67c571ea1394c39d9e0edf12bb082a81ae1137378c55b7d31ae86f8f1c90b0d9a497a79ac1690af696
SSDEEP 384:TZosX6jqrvqFdGPxeuaAUDJU0yKsbXUqXVOjAeGTB0qXfGQ4NEL3LN7qRt:N5XrzqFdoxeuFUKRKsbEqVWi0jED5
TLSH
T167234BCF962564B2CBED023831FBBB130D7A6E34D1AD84D3DAE35E859D705064915E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
5080	zongximk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zongxim.dll	jaffacakes118_8e5ef727edf618e90b0feaee86fc6798e64307ba6ba262e0271317b71f5c1472.exe
File created	C:\Windows\SysWOW64\zongximk.exe	jaffacakes118_8e5ef727edf618e90b0feaee86fc6798e64307ba6ba262e0271317b71f5c1472.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1904	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_8e5ef727edf618e90b0feaee86fc6798e64307ba6ba262e0271317b71f5c1472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zongximk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 5080	5036	jaffacakes118_8e5ef727edf618e90b0feaee86fc6798e64307ba6ba262e0271317b71f5c1472.exe	89
PID 5036 wrote to memory of 1904	5036	jaffacakes118_8e5ef727edf618e90b0feaee86fc6798e64307ba6ba262e0271317b71f5c1472.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8e5ef727edf618e90b0feaee86fc6798e64307ba6ba262e0271317b71f5c1472.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8e5ef727edf618e90b0feaee86fc6798e64307ba6ba262e0271317b71f5c1472.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\zongximk.exe
  C:\Windows\system32\zongximk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8e5ef727edf618e90b0feaee86fc6798e64307ba6ba262e0271317b71f5c1472.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_8e5ef727edf618e90b0feaee86fc6798e64307ba6ba262e0271317b71f5c1472.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8e5ef727edf618e90b0feaee86fc6798e64307ba6ba262e0271317b71f5c1472.exe.bat
Size 274B
SHA256 c3ac7dfbd9bbadfd69ad30101621a46e06da50446b4324dee54edbc7e5431286
MD5 13a4f2a1eaf8cb2abf400d5c6e374dda
SHA1 d266bc5bcbb4b59c5b15b11f96b2a146f3d10cdc
SHA512 b6c4344e5c8f81d99cc5af1cc45a64e526bf8aa777bb541769b6fc600bf7ad9f2c3cf5e282779cea244ffe098eef3e040402822a2ab02924db075d8e38166524
TLSH
T161D02BC4C279CE8135B2E51FC3215D4B45248D572F88FFD0163280893153229B3DB300
MD5 SHA1 SHA512 TLSH

Submit Download

zongximk.exe

Path C:\Windows\SysWOW64\zongximk.exe
Size 48KB
SHA256 8e5ef727edf618e90b0feaee86fc6798e64307ba6ba262e0271317b71f5c1472
MD5 f48d0384ce1fd774f93065190e0c60d1
SHA1 efaa7a3057ab61f4cdb2211dc82785897a6c3a1d
SHA512 f5ee7250288eb7ed0db69e9ddf26a8d55aadadedfe92ee67c571ea1394c39d9e0edf12bb082a81ae1137378c55b7d31ae86f8f1c90b0d9a497a79ac1690af696
SSDEEP 384:TZosX6jqrvqFdGPxeuaAUDJU0yKsbXUqXVOjAeGTB0qXfGQ4NEL3LN7qRt:N5XrzqFdoxeuFUKRKsbEqVWi0jED5
TLSH
T167234BCF962564B2CBED023831FBBB130D7A6E34D1AD84D3DAE35E859D705064915E0B
MD5 SHA1 SHA512 SSDEEP TLSH