d7676fe7e057e83239f3a8a0e1d7b6322d16b6046250400a86faa0cf7e76745d

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 05:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_d7676fe7e057e83239f3a8a0e1d7b6322d16b6046250400a86faa0cf7e76745d.exe
Size 52KB
Sample260924-gdfd2asx2n
SHA256 d7676fe7e057e83239f3a8a0e1d7b6322d16b6046250400a86faa0cf7e76745d
MD5 95a0a765c03f2bbe220886cb530030b0
SHA1 31a7a01d57495564fb58a9cd5927bd5133d5cb79
SHA512 89480cd71834c8017cd0708e1de57b194967701848e519d96f533c443e4c94329de24ecbb228c17e0401e29ec106cd35e5b1afdbe6b8cc4d86f2ef17ebe1e3a9
SSDEEP 384:Z2l9TgEuKV3vqFd/y3PrFaF5z8PA3tnyBePAUIfUQxGLtq3tp9:kpgZ0fqFdewFSPiyBePAXfUhLi
TLSH
T15033284FD510F8B3CBBE13783A845D1729BE2C35221508E7C66797E45CA0B5988A5F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
920	zongximk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zongxim.dll	jaffacakes118_d7676fe7e057e83239f3a8a0e1d7b6322d16b6046250400a86faa0cf7e76745d.exe
File created	C:\Windows\SysWOW64\zongximk.exe	jaffacakes118_d7676fe7e057e83239f3a8a0e1d7b6322d16b6046250400a86faa0cf7e76745d.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5728	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_d7676fe7e057e83239f3a8a0e1d7b6322d16b6046250400a86faa0cf7e76745d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zongximk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 360 wrote to memory of 920	360	jaffacakes118_d7676fe7e057e83239f3a8a0e1d7b6322d16b6046250400a86faa0cf7e76745d.exe	89
PID 360 wrote to memory of 5728	360	jaffacakes118_d7676fe7e057e83239f3a8a0e1d7b6322d16b6046250400a86faa0cf7e76745d.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d7676fe7e057e83239f3a8a0e1d7b6322d16b6046250400a86faa0cf7e76745d.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d7676fe7e057e83239f3a8a0e1d7b6322d16b6046250400a86faa0cf7e76745d.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:360
- C:\Windows\SysWOW64\zongximk.exe
  C:\Windows\system32\zongximk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d7676fe7e057e83239f3a8a0e1d7b6322d16b6046250400a86faa0cf7e76745d.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_d7676fe7e057e83239f3a8a0e1d7b6322d16b6046250400a86faa0cf7e76745d.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d7676fe7e057e83239f3a8a0e1d7b6322d16b6046250400a86faa0cf7e76745d.exe.bat
Size 274B
SHA256 2fa729e53ae3051d23cc83ffa5eac96ffab0149b2025b297f9b418cd3e19b160
MD5 990eaf874f7c0b2feb8ecab4bfc3b6c8
SHA1 e426626905a48c114deaa7b705dadbf4831da4aa
SHA512 21e7f56c1a3aa5f7f7956f417b7ab389e58ab6e638a806fdfabcf0545732c15201c45b949396e69288434f5e2a1c2e474b7afea636d640cf284664b961cb2930
TLSH
T13CD02B005336C5694C26E45F0E7CB78EC111077833AC2B214A71C3C8D1B282CB38EB04
MD5 SHA1 SHA512 TLSH

Submit Download

zongximk.exe

Path C:\Windows\SysWOW64\zongximk.exe
Size 52KB
SHA256 d7676fe7e057e83239f3a8a0e1d7b6322d16b6046250400a86faa0cf7e76745d
MD5 95a0a765c03f2bbe220886cb530030b0
SHA1 31a7a01d57495564fb58a9cd5927bd5133d5cb79
SHA512 89480cd71834c8017cd0708e1de57b194967701848e519d96f533c443e4c94329de24ecbb228c17e0401e29ec106cd35e5b1afdbe6b8cc4d86f2ef17ebe1e3a9
SSDEEP 384:Z2l9TgEuKV3vqFd/y3PrFaF5z8PA3tnyBePAUIfUQxGLtq3tp9:kpgZ0fqFdewFSPiyBePAXfUhLi
TLSH
T15033284FD510F8B3CBBE13783A845D1729BE2C35221508E7C66797E45CA0B5988A5F4F
MD5 SHA1 SHA512 SSDEEP TLSH