218967eb882ccca95d8d01f90f2c3b3e8a184c3b9e64d1b0d314516404b1b17f

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Email-Worm.Win32.Klez.k.exe
Size 77KB
Sample261009-tp4bfsbv5v
SHA256 218967eb882ccca95d8d01f90f2c3b3e8a184c3b9e64d1b0d314516404b1b17f
MD5 38164a9e06f9b79a0529debb716f8ed0
SHA1 8eeb511946fdc3979db043ca5626e4bd9ccc8837
SHA512 3add384821e60340c4d6f4f0a003ab281b8de8c559f611a3870ab0f98cdea3983c4c846cd77ab2f18db861045077ea6c00534232b59db8c32fdf73bb1249942d
SSDEEP 768:zXS6Lnze1gshn5ew/QuBdL/4Ckir4SWeq3HwFdkt+Afs2DBnotv0p//gK6KcgM/:TSSnze1gsJ55n/4CkOwwF+bhotwj8
TLSH
T109736C2379908473C8AA4D70116E4712CABEF4311B5AEAC3F719995B7F207D1EA3634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3608	Winkipz.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Winkipz.exe	jaffacakes118_Email-Worm.Win32.Klez.k.exe
File created	C:\Windows\SysWOW64\Winkipz.exe	jaffacakes118_Email-Worm.Win32.Klez.k.exe
File opened for modification	C:\Windows\SysWOW64\Winkipz.exe	Winkipz.exe
File created	C:\Windows\SysWOW64\Winkipz.exe	Winkipz.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Email-Worm.Win32.Klez.k.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	3060	jaffacakes118_Email-Worm.Win32.Klez.k.exe
Token: SeTcbPrivilege	3608	Winkipz.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Email-Worm.Win32.Klez.k.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Email-Worm.Win32.Klez.k.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3060

C:\Windows\SysWOW64\Winkipz.exe
C:\Windows\SysWOW64\Winkipz.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Winkipz.exe

Path C:\Windows\SysWOW64\Winkipz.exe
Size 80KB
SHA256 aa2bddec0e853012a0342b602de829e708b3031967a3fb4a2d9e635b9daa0ac9
MD5 42d73bdade8f5103f505b6189a9a3653
SHA1 dda3babf4fe982720d0f8e268e93a5563371029e
SHA512 b38c892ebc6979eb180327832f0bb1ee31c652877345ccf6b48ad48f4cf1cdc540887b26052871ef3f07ec5a3102f3a9b9b0d549d4e7df9930d17a13903849cf
SSDEEP 768:zXS6Lnze1gshn5ew/QuBdL/4Ckir4SWeq3HwFdkt+Afs2DBnoNq/5VkK6KcgM/:TSSnze1gsJ55n/4CkOwwF+bhoNqhV/8
TLSH
T17A836C2379908473C8A64370126A5B114AFFE83117DADAC3F71D995A7F306D1EA3634B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download