b01464ffd5e80dcc8100c06cab63a16bb85698cdf63588f1d6d39c70ef77018d

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Dapato.pckk.exe
Size 1.8MB
Sample261009-we93cssy8r
SHA256 b01464ffd5e80dcc8100c06cab63a16bb85698cdf63588f1d6d39c70ef77018d
MD5 b734c30ac54873b2cdb84fb936ccf668
SHA1 18a2ca19e00274c4fc40b60f10c976c0094b675a
SHA512 81813558272df8e5c3f2077e31d5ff0e0873b67bd39853ac66cd0c25ba058b2c9519066fc53b0bcc19d0b213666aa91f1d5b280e47a5d21e64393a503c91b58a
SSDEEP 49152:RzbZDEJIsIxTgACSqPRIXdqGvTop/QhVvw4j:Rz2dIx6SldOQ
TLSH
T13B959E02A7C080B2E64E17751167E7BA5E399D354328C5CBD7A03D759E312D3AA3B38E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4056	Wingmt.exe
4152	Wingmt.exe

Loads dropped DLL 2 IoCs

pid	Process
4056	Wingmt.exe
4152	Wingmt.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Wingmt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Wingmt.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Dapato.pckk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wingmt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wingmt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4372	jaffacakes118_Trojan-Dropper.Win32.Dapato.pckk.exe
Token: SeIncBasePriorityPrivilege	4372	jaffacakes118_Trojan-Dropper.Win32.Dapato.pckk.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4056	4372	jaffacakes118_Trojan-Dropper.Win32.Dapato.pckk.exe	89
PID 4372 wrote to memory of 3408	4372	jaffacakes118_Trojan-Dropper.Win32.Dapato.pckk.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Dapato.pckk.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Dapato.pckk.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Roaming\WatchSend\Wingmt.exe
  "C:\Users\Admin\AppData\Roaming\WatchSend\Wingmt.exe" -install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Dapato.pckk.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3408

C:\Users\Admin\AppData\Roaming\WatchSend\Wingmt.exe
C:\Users\Admin\AppData\Roaming\WatchSend\Wingmt.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Wingmt.exe

Path C:\Users\Admin\AppData\Roaming\WatchSend\Wingmt.exe
Size 226KB
SHA256 eadeba505593ce2585f7114688daa6237744bf7375022b9b8dbc28ce1179eb4a
MD5 3bcd4d3042e9dba7b9ee4813795e19fe
SHA1 c0ad7d7a40a4b5e49b82ff593d7a71696732bdae
SHA512 73775c61a535c39ec9b1c31ae29a2a64860b44c0158cc2206ca0291c8e3b3f614ed6f5921ecc83440d6202149565ee64da80efec2fb7c86d7728a0714fae947a
SSDEEP 3072:S5mN8WBxXXcvUnQuJa3Rpd6qLvF62WqzCmszA2lAiaL52Mpy:cmlxqUnFs3RqqLt6YszTAMMp
TLSH
T15D3429217600C032E75B0B7559A9E6E96668AD3817D4E4CFF3A83E7A5E712E3193310F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

utility.dll

Path C:\Users\Admin\AppData\Roaming\WatchSend\utility.dll
Size 1.5MB
SHA256 33df38a3895c78c2adb0182d3458e6576ec5e55250c912d0d1400db8842cef48
MD5 2e8a15816728ca4e86c120982837309e
SHA1 e85bbfb92e1bcf0593a3427fd933c690494f706f
SHA512 bc671b67c4e0634e5ef1996a68409ea6b01d4b73818509d3a708fced2df438914b69f8546f9af6d425fbc3e6911f9e6d0c93a159d29e5addb0307de29ddb00a9
SSDEEP 24576:dctCLw5OMFRL+nJZxE7nUwxdiACSqP0kIXh5FM0nHIlLipGoTop/PYhVvw4j:ksIxTgACSqPRIXdqGvTop/QhVvw4j
TLSH
T194659F43EBC180B2E89E52791173A77F5E359A114329C6D39BE03D61DE312E1AB3D389
MD5 SHA1 SHA512 SSDEEP TLSH