30101828f3f3fbbee60f86eae6bbd5e4f57851a887562ee32501b61e53bdfd24

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_30101828f3f3fbbee60f86eae6bbd5e4f57851a887562ee32501b61e53bdfd24.exe
Size 52KB
Sample260925-2ct61syakf
SHA256 30101828f3f3fbbee60f86eae6bbd5e4f57851a887562ee32501b61e53bdfd24
MD5 af7fd216a1e3f9387bd138642159d665
SHA1 dcc116cf4c03d365bea37c37fae314ddc8441475
SHA512 bef59a883017d8ace906b480c92c5ef2309683b410a48261bae2f195990c90ffd91f59ab39ea3a1e78c27de7d6d0aea826ce6c039c3665a4dbb03c53bc0eb89f
SSDEEP 768:8aqrSqFYrtK9ZAeZIHzThTTT8rTIDYUvpoPl:8hrbmrzaI1TNDYUvm
TLSH
T1CB332A4B9A108AB2CFAE0278BA875F1F677F7D35121100B7D76399D45C79B9A08E4C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
3320	wonlinsk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wonlins.dll	jaffacakes118_30101828f3f3fbbee60f86eae6bbd5e4f57851a887562ee32501b61e53bdfd24.exe
File created	C:\Windows\SysWOW64\wonlinsk.exe	jaffacakes118_30101828f3f3fbbee60f86eae6bbd5e4f57851a887562ee32501b61e53bdfd24.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2504	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_30101828f3f3fbbee60f86eae6bbd5e4f57851a887562ee32501b61e53bdfd24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wonlinsk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 3320	3344	jaffacakes118_30101828f3f3fbbee60f86eae6bbd5e4f57851a887562ee32501b61e53bdfd24.exe	90
PID 3344 wrote to memory of 2504	3344	jaffacakes118_30101828f3f3fbbee60f86eae6bbd5e4f57851a887562ee32501b61e53bdfd24.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_30101828f3f3fbbee60f86eae6bbd5e4f57851a887562ee32501b61e53bdfd24.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_30101828f3f3fbbee60f86eae6bbd5e4f57851a887562ee32501b61e53bdfd24.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\SysWOW64\wonlinsk.exe
  C:\Windows\system32\wonlinsk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_30101828f3f3fbbee60f86eae6bbd5e4f57851a887562ee32501b61e53bdfd24.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_30101828f3f3fbbee60f86eae6bbd5e4f57851a887562ee32501b61e53bdfd24.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_30101828f3f3fbbee60f86eae6bbd5e4f57851a887562ee32501b61e53bdfd24.exe.bat
Size 274B
SHA256 fb0e329818e29fe6d78796412ff2c7c8bd0cdd956607e5b3db44eea14f791cd7
MD5 270edaf8a955b9825e21133fdcb0102d
SHA1 4221120d44efd9b88dae30702e6bdbd1068c62e1
SHA512 90f431c72b4bf471ad16e6b28996e941656742d3c32cb72f2d4ed20e256840ba10008370231623e01f718c3a03f780c80256d2f970a7564d1d8bdf6b0e276abb
TLSH
T1C2D02B468381C9B00CC3EC0F1D381B46B5910EA413C42F221F5084B01461449F2C2309
MD5 SHA1 SHA512 TLSH

Submit Download

wonlinsk.exe

Path C:\Windows\SysWOW64\wonlinsk.exe
Size 52KB
SHA256 30101828f3f3fbbee60f86eae6bbd5e4f57851a887562ee32501b61e53bdfd24
MD5 af7fd216a1e3f9387bd138642159d665
SHA1 dcc116cf4c03d365bea37c37fae314ddc8441475
SHA512 bef59a883017d8ace906b480c92c5ef2309683b410a48261bae2f195990c90ffd91f59ab39ea3a1e78c27de7d6d0aea826ce6c039c3665a4dbb03c53bc0eb89f
SSDEEP 768:8aqrSqFYrtK9ZAeZIHzThTTT8rTIDYUvpoPl:8hrbmrzaI1TNDYUvm
TLSH
T1CB332A4B9A108AB2CFAE0278BA875F1F677F7D35121100B7D76399D45C79B9A08E4C0B
MD5 SHA1 SHA512 SSDEEP TLSH