748cc584b06e9584ead5bea473b5e7b9386116d47f3c72d25c75f77f387c2a0d

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_748cc584b06e9584ead5bea473b5e7b9386116d47f3c72d25c75f77f387c2a0d.exe
Size 52KB
Sample260930-mama3ayglb
SHA256 748cc584b06e9584ead5bea473b5e7b9386116d47f3c72d25c75f77f387c2a0d
MD5 0feeaf940581bc5d35376525c6f28a7b
SHA1 541351c6c0b61751de93e66425787c11c2cf0d41
SHA512 1dd13312946df8e6bfca726a68c2319038e26b387dc1fde21b728d1babc728b4204322354bc9a45adfe1154fb103ea7ac62c237a6c94b51bc95be86b07eed154
SSDEEP 384:f8YSx24oax1E+5XfvqFtN3oK71J8GclaZ+aLiXgh28QxhLQq3tf9twO:fDSx24oK1ZxXqFty+8QZ+8iX6zGLft1
TLSH
T18533074BD510F8B3DBAA13783A946D1B2AAF6C35211504E3CBA397E45C64B4D88A5F0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
5860	zongximk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zongxim.dll	jaffacakes118_748cc584b06e9584ead5bea473b5e7b9386116d47f3c72d25c75f77f387c2a0d.exe
File created	C:\Windows\SysWOW64\zongximk.exe	jaffacakes118_748cc584b06e9584ead5bea473b5e7b9386116d47f3c72d25c75f77f387c2a0d.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4188	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zongximk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_748cc584b06e9584ead5bea473b5e7b9386116d47f3c72d25c75f77f387c2a0d.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 5860	472	jaffacakes118_748cc584b06e9584ead5bea473b5e7b9386116d47f3c72d25c75f77f387c2a0d.exe	89
PID 472 wrote to memory of 4188	472	jaffacakes118_748cc584b06e9584ead5bea473b5e7b9386116d47f3c72d25c75f77f387c2a0d.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_748cc584b06e9584ead5bea473b5e7b9386116d47f3c72d25c75f77f387c2a0d.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_748cc584b06e9584ead5bea473b5e7b9386116d47f3c72d25c75f77f387c2a0d.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:472
- C:\Windows\SysWOW64\zongximk.exe
  C:\Windows\system32\zongximk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_748cc584b06e9584ead5bea473b5e7b9386116d47f3c72d25c75f77f387c2a0d.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_748cc584b06e9584ead5bea473b5e7b9386116d47f3c72d25c75f77f387c2a0d.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_748cc584b06e9584ead5bea473b5e7b9386116d47f3c72d25c75f77f387c2a0d.exe.bat
Size 274B
SHA256 be0952f9db199b14f02e5c17decc9142851f55a370c24d2a6a72a6ba4f42457b
MD5 1e2f227a6b2a785d548c406830dc6129
SHA1 685c5051fc900c1c0181cc5fc2676f6be85a473a
SHA512 ee61b74961ac439f40c7a92722ed37a089d25033871ff8b0a59b59631c4790becc4623447c6b8af11ef088e97f7b0343ccb8afae4f6b970563b543b51e11dc1a
TLSH
T18DD02B5183328D8F441AF43F007C938C80301E501FCC6F150A6143C4224A034F695371
MD5 SHA1 SHA512 TLSH

Submit Download

zongximk.exe

Path C:\Windows\SysWOW64\zongximk.exe
Size 52KB
SHA256 748cc584b06e9584ead5bea473b5e7b9386116d47f3c72d25c75f77f387c2a0d
MD5 0feeaf940581bc5d35376525c6f28a7b
SHA1 541351c6c0b61751de93e66425787c11c2cf0d41
SHA512 1dd13312946df8e6bfca726a68c2319038e26b387dc1fde21b728d1babc728b4204322354bc9a45adfe1154fb103ea7ac62c237a6c94b51bc95be86b07eed154
SSDEEP 384:f8YSx24oax1E+5XfvqFtN3oK71J8GclaZ+aLiXgh28QxhLQq3tf9twO:fDSx24oK1ZxXqFty+8QZ+8iX6zGLft1
TLSH
T18533074BD510F8B3DBAA13783A946D1B2AAF6C35211504E3CBA397E45C64B4D88A5F0F
MD5 SHA1 SHA512 SSDEEP TLSH