3d4b16c251489d57edb3112833e8dd1a78f74b82de51d53c0a690935bd10a0c5

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_3d4b16c251489d57edb3112833e8dd1a78f74b82de51d53c0a690935bd10a0c5.exe
Size 48KB
Sample260924-gpv9mafd64
SHA256 3d4b16c251489d57edb3112833e8dd1a78f74b82de51d53c0a690935bd10a0c5
MD5 1bcb48c50019bd47cf2117593a67a267
SHA1 453d703b7dfc86c133eb3763bd02e993b360703f
SHA512 538cf87bed0eb43b67b15ee02a3f6dd1b3624840c761cdbbb746a3d76aee655c62558e1769277df2ef593d33de18a6015ab915da7dff0eebc217412a8a1e3cec
SSDEEP 768:IYxTDQceJZYSZcEaNNTI9UNRRKBUTsTyQTV+vrgSlsw:tTDeJaqcEaNN9RKt+vrnls
TLSH
T1F6234B4B61005AF2C2D8C87839C3AB1B66EE6D34031A24A3DFB755C94F6958F79A2D07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
5976	xuntxnk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xuntxn.dll	jaffacakes118_3d4b16c251489d57edb3112833e8dd1a78f74b82de51d53c0a690935bd10a0c5.exe
File created	C:\Windows\SysWOW64\xuntxnk.exe	jaffacakes118_3d4b16c251489d57edb3112833e8dd1a78f74b82de51d53c0a690935bd10a0c5.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1816	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_3d4b16c251489d57edb3112833e8dd1a78f74b82de51d53c0a690935bd10a0c5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xuntxnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1876	jaffacakes118_3d4b16c251489d57edb3112833e8dd1a78f74b82de51d53c0a690935bd10a0c5.exe
1876	jaffacakes118_3d4b16c251489d57edb3112833e8dd1a78f74b82de51d53c0a690935bd10a0c5.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 5976	1876	jaffacakes118_3d4b16c251489d57edb3112833e8dd1a78f74b82de51d53c0a690935bd10a0c5.exe	89
PID 1876 wrote to memory of 1816	1876	jaffacakes118_3d4b16c251489d57edb3112833e8dd1a78f74b82de51d53c0a690935bd10a0c5.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3d4b16c251489d57edb3112833e8dd1a78f74b82de51d53c0a690935bd10a0c5.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3d4b16c251489d57edb3112833e8dd1a78f74b82de51d53c0a690935bd10a0c5.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\xuntxnk.exe
  C:\Windows\system32\xuntxnk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3d4b16c251489d57edb3112833e8dd1a78f74b82de51d53c0a690935bd10a0c5.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_3d4b16c251489d57edb3112833e8dd1a78f74b82de51d53c0a690935bd10a0c5.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3d4b16c251489d57edb3112833e8dd1a78f74b82de51d53c0a690935bd10a0c5.exe.bat
Size 265B
SHA256 e07952de7edd5813a87fdfedc001cd62b897d9f416156e316d5a0db9cc5fbb32
MD5 5ea63c3d83684d4a9deda87cf4e6b126
SHA1 947b903c10ca1d334fe3d0fe2ac0f3a7bc08bfbf
SHA512 4cf76d6f88c4ea0314d5bea587966b45b8b10e56a7e793eab81e0ee90fb810bc2da3ab32d9475eb77f2ac088106fb9221fb8c577e23cc391bcb02c6b5844033a
TLSH
T1DCD05E40518ACB7A0954FD3B8AB28BDA88A148AA77482B574621D4ED158480CAEB568A
MD5 SHA1 SHA512 TLSH

Submit Download

xuntxnk.exe

Path C:\Windows\SysWOW64\xuntxnk.exe
Size 48KB
SHA256 3d4b16c251489d57edb3112833e8dd1a78f74b82de51d53c0a690935bd10a0c5
MD5 1bcb48c50019bd47cf2117593a67a267
SHA1 453d703b7dfc86c133eb3763bd02e993b360703f
SHA512 538cf87bed0eb43b67b15ee02a3f6dd1b3624840c761cdbbb746a3d76aee655c62558e1769277df2ef593d33de18a6015ab915da7dff0eebc217412a8a1e3cec
SSDEEP 768:IYxTDQceJZYSZcEaNNTI9UNRRKBUTsTyQTV+vrgSlsw:tTDeJaqcEaNN9RKt+vrnls
TLSH
T1F6234B4B61005AF2C2D8C87839C3AB1B66EE6D34031A24A3DFB755C94F6958F79A2D07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download