bea51f6e2b76333cb39f756cc186846ff32b1a319fe2e5d11f4e6dab6c8e9bcf

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_bea51f6e2b76333cb39f756cc186846ff32b1a319fe2e5d11f4e6dab6c8e9bcf.exe
Size 52KB
Sample260924-mt5xhsbf84
SHA256 bea51f6e2b76333cb39f756cc186846ff32b1a319fe2e5d11f4e6dab6c8e9bcf
MD5 cb6c43ec76aa8cb17d79780f4347e3c0
SHA1 15dbdb6758c8de61a940ebb6245daa3498f551c0
SHA512 2918e60ac62f92f0793c7f809ade7013c760d91af04c7c352d9a1f49effed678ebdc51b9aad90ef3100f76e606a18c2318038ccde31bf3ecc8507f3ec42b9c01
SSDEEP 768:160HXRiqFz09SkeQPRqMrQVuifC9anOn:16sRLiA1w4F
TLSH
T1FA334A0FD600F8B3D2AA82743E546E2B697F3C36111408EBD7279BD06C64A5D88A0F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4344	zongximk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zongximk.exe	jaffacakes118_bea51f6e2b76333cb39f756cc186846ff32b1a319fe2e5d11f4e6dab6c8e9bcf.exe
File created	C:\Windows\SysWOW64\zongxim.dll	jaffacakes118_bea51f6e2b76333cb39f756cc186846ff32b1a319fe2e5d11f4e6dab6c8e9bcf.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6096	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_bea51f6e2b76333cb39f756cc186846ff32b1a319fe2e5d11f4e6dab6c8e9bcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zongximk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 4344	3688	jaffacakes118_bea51f6e2b76333cb39f756cc186846ff32b1a319fe2e5d11f4e6dab6c8e9bcf.exe	90
PID 3688 wrote to memory of 6096	3688	jaffacakes118_bea51f6e2b76333cb39f756cc186846ff32b1a319fe2e5d11f4e6dab6c8e9bcf.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_bea51f6e2b76333cb39f756cc186846ff32b1a319fe2e5d11f4e6dab6c8e9bcf.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_bea51f6e2b76333cb39f756cc186846ff32b1a319fe2e5d11f4e6dab6c8e9bcf.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\SysWOW64\zongximk.exe
  C:\Windows\system32\zongximk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_bea51f6e2b76333cb39f756cc186846ff32b1a319fe2e5d11f4e6dab6c8e9bcf.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_bea51f6e2b76333cb39f756cc186846ff32b1a319fe2e5d11f4e6dab6c8e9bcf.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_bea51f6e2b76333cb39f756cc186846ff32b1a319fe2e5d11f4e6dab6c8e9bcf.exe.bat
Size 274B
SHA256 65d631385822642fb61c2ae8609d7353b2b6c23051e778f9336ab3d20a6b461d
MD5 25ce4c017545d8ac6f150dd873e31012
SHA1 ea346a86345139ded59c19ee31bf84f3577fef6f
SHA512 1f816dc92366297fa4faa668a7e60b098afc34321fc15bbf70e3f818cdb80f475e8229b6f5fd6f5d90e7c455d23dd29dc7175760e03662f28f3125072b5e92bd
TLSH
T173D02BAC81A6D48E5808971F4830174B41136B6821C52F120333C5D41393034FECB380
MD5 SHA1 SHA512 TLSH

Submit Download

zongximk.exe

Path C:\Windows\SysWOW64\zongximk.exe
Size 52KB
SHA256 bea51f6e2b76333cb39f756cc186846ff32b1a319fe2e5d11f4e6dab6c8e9bcf
MD5 cb6c43ec76aa8cb17d79780f4347e3c0
SHA1 15dbdb6758c8de61a940ebb6245daa3498f551c0
SHA512 2918e60ac62f92f0793c7f809ade7013c760d91af04c7c352d9a1f49effed678ebdc51b9aad90ef3100f76e606a18c2318038ccde31bf3ecc8507f3ec42b9c01
SSDEEP 768:160HXRiqFz09SkeQPRqMrQVuifC9anOn:16sRLiA1w4F
TLSH
T1FA334A0FD600F8B3D2AA82743E546E2B697F3C36111408EBD7279BD06C64A5D88A0F5F
MD5 SHA1 SHA512 SSDEEP TLSH