3a5a07e54fed28f352b3fe02a138dd677baaa690477528ed9891890666e90306

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_3a5a07e54fed28f352b3fe02a138dd677baaa690477528ed9891890666e90306.exe
Size 44KB
Sample260925-w5175stdrd
SHA256 3a5a07e54fed28f352b3fe02a138dd677baaa690477528ed9891890666e90306
MD5 2ad67fd69c9b28951253fbd6ee67b358
SHA1 aa5aeb1c28c3c8bbbdf8e275a60328465c8a9672
SHA512 e219b147f87b64f7c9188cd440517a279cb59a9bf444c7e58d359a7137b0e4c4abff757b5584799993d097226a80b3e2757a6f7aee64577912222353cb571a0d
SSDEEP 384:wTTPW4/d9vNgk9UxbpKHWVtBM7Lewspct5:8p1NgwUxrVnM7Lewsat5
TLSH
T13A134B879F0488B2C3DA4574354B973B5BBB6E31136798A3C7B36AC22C349E48E35617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
5324	rmbsonyk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rmbsony.dll	jaffacakes118_3a5a07e54fed28f352b3fe02a138dd677baaa690477528ed9891890666e90306.exe
File created	C:\Windows\SysWOW64\rmbsonyk.exe	jaffacakes118_3a5a07e54fed28f352b3fe02a138dd677baaa690477528ed9891890666e90306.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5500	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_3a5a07e54fed28f352b3fe02a138dd677baaa690477528ed9891890666e90306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmbsonyk.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 5324	3104	jaffacakes118_3a5a07e54fed28f352b3fe02a138dd677baaa690477528ed9891890666e90306.exe	89
PID 3104 wrote to memory of 5500	3104	jaffacakes118_3a5a07e54fed28f352b3fe02a138dd677baaa690477528ed9891890666e90306.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3a5a07e54fed28f352b3fe02a138dd677baaa690477528ed9891890666e90306.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3a5a07e54fed28f352b3fe02a138dd677baaa690477528ed9891890666e90306.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\SysWOW64\rmbsonyk.exe
  C:\Windows\system32\rmbsonyk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3a5a07e54fed28f352b3fe02a138dd677baaa690477528ed9891890666e90306.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_3a5a07e54fed28f352b3fe02a138dd677baaa690477528ed9891890666e90306.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3a5a07e54fed28f352b3fe02a138dd677baaa690477528ed9891890666e90306.exe.bat
Size 274B
SHA256 07a692bd9b8bb9b7811f3b4f987539a1eb71c8d28c20c51ab0a9825a73005b4a
MD5 e47fb703a279720c035848bffb1cf79a
SHA1 13462c8b5950d0db28526045341b09e7ff344060
SHA512 15d13b1ce962f7aa380cf5317a04ca904a984d1ba1a556b119d66d75f14a5356548e296d585de1dbd4db6f3d5bcf18a4afc045fad10bab6200037e4bb1915f71
TLSH
T180D02B80D2F385D20800A53BCA368A8C8118555D2E493F119734C2C80073004A7F668C
MD5 SHA1 SHA512 TLSH

Submit Download

rmbsonyk.exe

Path C:\Windows\SysWOW64\rmbsonyk.exe
Size 44KB
SHA256 3a5a07e54fed28f352b3fe02a138dd677baaa690477528ed9891890666e90306
MD5 2ad67fd69c9b28951253fbd6ee67b358
SHA1 aa5aeb1c28c3c8bbbdf8e275a60328465c8a9672
SHA512 e219b147f87b64f7c9188cd440517a279cb59a9bf444c7e58d359a7137b0e4c4abff757b5584799993d097226a80b3e2757a6f7aee64577912222353cb571a0d
SSDEEP 384:wTTPW4/d9vNgk9UxbpKHWVtBM7Lewspct5:8p1NgwUxrVnM7Lewsat5
TLSH
T13A134B879F0488B2C3DA4574354B973B5BBB6E31136798A3C7B36AC22C349E48E35617
MD5 SHA1 SHA512 SSDEEP TLSH