Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/09/2026, 11:39
Behavioral task
behavioral1
Sample
jaffacakes118__9073e2f1febbfe4209356ecdc04e34d8.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__9073e2f1febbfe4209356ecdc04e34d8.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118__9073e2f1febbfe4209356ecdc04e34d8.exe
- Size 310KB
- Sample260919-nsa67azdpc
- SHA256 a78b09d1f9602b231afce637dce5f83140da860e515f67f3f2766bc4bd7b3fcd
- MD5 9073e2f1febbfe4209356ecdc04e34d8
- SHA1 015199f6e44f793e8601293e53ad6433e4b1d573
- SHA512 2c0185ad8f7b3e4a47b3a1a83f2d948738174fe15829afd10f2065b59430681329851e419577f4d2d9cf8ebc17376a5b6ac08b9786b1fd1ba1b683fd1644aa9e
- SSDEEP 3072:vPBWXOjZKFTV+cHlTv3nAs1UuONBF9FhtsyvT0evRmN2I4UDAVfAHe:hWXWATQcxArtNHhtsyXmAUDAlA
- TLSH T1D4641272CF65C0BEC8CA74761029198FDA35DD33C5268513A3E47CADB876526CC1CABA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation jaffacakes118__9073e2f1febbfe4209356ecdc04e34d8.exe - Executes dropped EXE 1 IoCs
pid Process 2164 EXPLOPER.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__9073e2f1febbfe4209356ecdc04e34d8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXPLOPER.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe 2164 EXPLOPER.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2164 EXPLOPER.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe Token: SeDebugPrivilege 2164 EXPLOPER.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3736 wrote to memory of 2164 3736 jaffacakes118__9073e2f1febbfe4209356ecdc04e34d8.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9073e2f1febbfe4209356ecdc04e34d8.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9073e2f1febbfe4209356ecdc04e34d8.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\EXPLOPER.exe"C:\EXPLOPER.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2164
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4b4 0x3241⤵PID:2200
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\EXPLOPER.exe
- Size 18.2MB
- SHA256 ca1d47c79d65f53ce29ee3355148783ea9e4291431ee01755ae0242a9316e059
- MD5 05637b2b564041437ee0f6c19425865d
- SHA1 414de53621a058b73603308dd81fc31e4ae0e892
- SHA512 ad7f9ab2caa81199f838bbc3f59bcc979db54f389927a5a84ba6ea6c2f9f341285e8a4a9ae8bc590c27c3d397123c98e4ecb27196e9bb08c9194b19f60394cd0
- SSDEEP 3072:w+90UF8VuiKtsW2dJUfry1q7tuH57oBBkAptMn9:w+JF82snd6fry1KtwpcCADs
- TLSH T18617BEC3B2857CF9E440067404BBB7B26B3F8DA59259619AEF40FAB61D36594387E00F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\JoachimPeiper.dat
- Size 145B
- SHA256 633d3d1e7005db8b06235399a1bd1ee14d09b8372837319183a8e7b287cc0378
- MD5 54f1f875ac0892ea8757631c71190a10
- SHA1 210319829641d43d07421bd96195970b1d0f1763
- SHA512 1024a3304faf43cb57afcf06db0b94afa7a9d19cfcb2809c56e8eb9f0a38bb92678142b6ff0efd81e23abba796de4127a44b0f91db5e1908b65301a44a90b7c7
- TLSH T190C02BB73310795CDBEC8C54D30088031634D98001732C38078C5034776A19964FB0DD
- MD5 SHA1 SHA512 TLSH