eed73de3d7cdc4eca3b1265c6b7130513cc94fa7af70ac41a6ebd08706d9c35d

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eed73de3d7cdc4eca3b1265c6b7130513cc94fa7af70ac41a6ebd08706d9c35d.exe
Size 2.5MB
Sample260527-ppm71sdx2l
SHA256 eed73de3d7cdc4eca3b1265c6b7130513cc94fa7af70ac41a6ebd08706d9c35d
MD5 304a85467b349abf6fdf4d13f4f3a4ca
SHA1 bdd9b1db079274fb68e4857cfb89975d7c76b66a
SHA512 827919fd9ca20bb01bb5721bcf8cbd7bab04c50bddd0eadc0cdf4d49dde06328fbdedebc3422765c43a1656c68830284d06da8b4c32886dae4e06a097bad1a1b
SSDEEP 49152:KUFgHIEt9WBtoFcrfW4jdGRFrgmlsGjfxymW:Kigtt9WBtoFcrfW4gHt
TLSH
T1B3C5BEE6AE528045EF70E0B4B697D0492F554A41CF3F1C62468EE805E2777E83D9BB0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	eed73de3d7cdc4eca3b1265c6b7130513cc94fa7af70ac41a6ebd08706d9c35d.exe

Executes dropped EXE 2 IoCs

pid	Process
3020	jafejceeud.exe
3408	jafejceeud.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\WIFIInspector\WIFIInspector.exe	jafejceeud.tmp
File opened for modification	C:\Program Files (x86)\WIFIInspector\EGL.dll	jafejceeud.tmp
File created	C:\Program Files (x86)\WIFIInspector\unins000.dat	jafejceeud.tmp
File created	C:\Program Files (x86)\WIFIInspector\is-NCJMD.tmp	jafejceeud.tmp
File created	C:\Program Files (x86)\WIFIInspector\is-KG73P.tmp	jafejceeud.tmp
File created	C:\Program Files (x86)\WIFIInspector\is-PIMTQ.tmp	jafejceeud.tmp
File created	C:\Program Files (x86)\WIFIInspector\is-EGNK9.tmp	jafejceeud.tmp
File opened for modification	C:\Program Files (x86)\WIFIInspector\unins000.dat	jafejceeud.tmp
File created	C:\Program Files (x86)\WIFIInspector\is-AQR9S.tmp	jafejceeud.tmp
File created	C:\Program Files (x86)\WIFIInspector\is-JUMG1.tmp	jafejceeud.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eed73de3d7cdc4eca3b1265c6b7130513cc94fa7af70ac41a6ebd08706d9c35d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jafejceeud.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jafejceeud.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x000a0000000243e0-7.dat	innosetup
behavioral1/memory/3020-10-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral1/memory/3020-44-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3704	eed73de3d7cdc4eca3b1265c6b7130513cc94fa7af70ac41a6ebd08706d9c35d.exe
3704	eed73de3d7cdc4eca3b1265c6b7130513cc94fa7af70ac41a6ebd08706d9c35d.exe
3704	eed73de3d7cdc4eca3b1265c6b7130513cc94fa7af70ac41a6ebd08706d9c35d.exe
3704	eed73de3d7cdc4eca3b1265c6b7130513cc94fa7af70ac41a6ebd08706d9c35d.exe
3408	jafejceeud.tmp
3408	jafejceeud.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3408	jafejceeud.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 4760	3704	eed73de3d7cdc4eca3b1265c6b7130513cc94fa7af70ac41a6ebd08706d9c35d.exe	86
PID 4760 wrote to memory of 3020	4760	cmd.exe	88
PID 3020 wrote to memory of 3408	3020	jafejceeud.exe	89

C:\Users\Admin\AppData\Local\Temp\eed73de3d7cdc4eca3b1265c6b7130513cc94fa7af70ac41a6ebd08706d9c35d.exe
"C:\Users\Admin\AppData\Local\Temp\eed73de3d7cdc4eca3b1265c6b7130513cc94fa7af70ac41a6ebd08706d9c35d.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\jafejceeud.exe" /VERYSILENT
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Users\Admin\AppData\Local\Temp\jafejceeud.exe
    "C:\Users\Admin\AppData\Local\Temp\jafejceeud.exe" /VERYSILENT
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\is-7FN8K.tmp\jafejceeud.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-7FN8K.tmp\jafejceeud.tmp" /SL5="$F006E,90766,54272,C:\Users\Admin\AppData\Local\Temp\jafejceeud.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jafejceeud.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-7FN8K.tmp\jafejceeud.tmp
Size 900KB
SHA256 e8730b0bf8f94cbb8babbfefb32cef8e8d19ec823f28c33a7d48c78589710762
MD5 f8b110dc2063d3b29502aa7042d26122
SHA1 1a0fd3db79eadc1ce714f6267d476ddbec0f5e79
SHA512 f3125d3f575aff68105ebb3eadbce30547d34e12237d8ebbc555c6fe12bcc0a5ea85a38e26f2900d70af70ec07efde3b8cd65dc0fdada637496531245ea5052f
SSDEEP 24576:dkHgKPNrPA37hzHIA6/oR36vln6sYEubnhRgZtnTZDExa/:d6frPA37hzHIA6/3UvjhRgZ9Te
TLSH
T122158C22F280C437C1B31A749E5786D5693BBE053E38A9DB7BF91F4C4E3964139262D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jafejceeud.exe

Path C:\Users\Admin\AppData\Local\Temp\jafejceeud.exe
Size 387KB
SHA256 7b9c5ed5f1c101fd42c207025ce61311bb8c6c49037a574a66352c3c21f7ba0d
MD5 8f49472ed2ec6b48b3e17200e35a6cc2
SHA1 2cd6519d99614e7f6450d4e24fc9b5796dd78233
SHA512 3fdda6ca38b83edc7bc77f3d6f63ae953b33ee38b870a5dbab72da2867767211352cb5d15076c073b9b8546b3844b3b180876537f78f2385d0160b3091bb57f9
SSDEEP 6144:IroybvFJQ/EC04JU89XgUfYF1pCT8v4ALwCXMv6B3fFB4pZzTtpwIOrA:7ybvF+9JDwUwfpdvNLo61fFBy91OU
TLSH
T140841227F6C154BAE532CA706D65D0088937BE311C34E82976ED5E6E8F37262A90F347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3020-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3020-9-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/3020-44-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3408-16-0x0000000000400000-0x00000000004F4000-memory.dmp

Download

memory/3408-22-0x0000000000400000-0x00000000004F4000-memory.dmp

Download

memory/3408-43-0x0000000000400000-0x00000000004F4000-memory.dmp

Download

memory/3704-0-0x0000000000890000-0x0000000000B1A000-memory.dmp

Download

memory/3704-2-0x0000000010000000-0x0000000010274000-memory.dmp

Download