Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/09/2026, 14:40
Behavioral task
behavioral1
Sample
jaffacakes118_11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target jaffacakes118_11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4.exe
- Size 1.3MB
- Sample260923-r18dfade62
- SHA256 11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4
- MD5 4ddb06e3956685e0f902e63c8b543bc5
- SHA1 8195b09a3207686162c216347415f0bf384c2497
- SHA512 cd6640c3bb9268fe7ff27a75ffcb2faaabc2b8906c6edbef158a4bdb47f928bc26b13b7aad688c46ac5db8cd16402f3782cddb7dfbc8831ed906e82176c2cb30
- SSDEEP 24576:sGPiuMdwsNDS5lSsjCqnstLyUktHIiLy/+:xuusNDS5lSHqnstLet3Ly/+
- TLSH T176557011A6F60235E0A6F93069B0520D457A7B25CC63CE1EF644DEDDBBB9972B830237
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Soulclose 2 IoCs
resource yara_rule behavioral2/memory/2552-0-0x0000000000400000-0x0000000000419000-memory.dmp family_soulclose behavioral2/files/0x000e00000001c58a-11.dat family_soulclose - Executes dropped EXE 1 IoCs
pid Process 4572 CCTV.exe - Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf CCTV.exe File created F:\autorun.inf CCTV.exe File opened for modification C:\autorun.inf CCTV.exe File created C:\autorun.inf CCTV.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe CCTV.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe CCTV.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE CCTV.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe CCTV.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe CCTV.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\javaws.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe CCTV.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe CCTV.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe CCTV.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe CCTV.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe CCTV.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe CCTV.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE CCTV.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe CCTV.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe CCTV.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe CCTV.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe CCTV.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE CCTV.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe CCTV.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe CCTV.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe CCTV.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe CCTV.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe CCTV.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\CCTV.exe jaffacakes118_11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4.exe File opened for modification C:\Windows\CCTV.exe jaffacakes118_11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4.exe File opened for modification C:\Windows\CCTV.exe CCTV.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1192 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2552 jaffacakes118_11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4.exe 4572 CCTV.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2552 wrote to memory of 1192 2552 jaffacakes118_11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4.exe 90 PID 2552 wrote to memory of 4572 2552 jaffacakes118_11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4kill.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1192
-
-
C:\Windows\CCTV.exeC:\Windows\CCTV.exe2⤵
- Executes dropped EXE
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4572
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4kill.bat
- Size 280B
- SHA256 fbaa1259a26532fa27950c86a7f57b9ba345f739a14ee0984ac1330c5d48b6bf
- MD5 9c93e2b4eaa50d663a0881924ebb289f
- SHA1 b9df4f62caae65a9376d2ae324d34c2f0755c23b
- SHA512 c57bdd43f5c9383392317c47c1d9089f2745a5c6f9197f4efe220d1cdb8d1870d0ca742da0b10f5481674028fe7378ea933b3e29c2983c51c5cc6dde54dbc2c4
- TLSH T170D02BCE536E495C4AA0FE8F0231A78EA71814713FCC2F20C13190DD61318257741E2A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\CCTV.exe
- Size 1.3MB
- SHA256 11c09c90a6db0e046d372fbdb63924e7f2d4fd1346a78ca005fbf673601462b4
- MD5 4ddb06e3956685e0f902e63c8b543bc5
- SHA1 8195b09a3207686162c216347415f0bf384c2497
- SHA512 cd6640c3bb9268fe7ff27a75ffcb2faaabc2b8906c6edbef158a4bdb47f928bc26b13b7aad688c46ac5db8cd16402f3782cddb7dfbc8831ed906e82176c2cb30
- SSDEEP 24576:sGPiuMdwsNDS5lSsjCqnstLyUktHIiLy/+:xuusNDS5lSHqnstLet3Ly/+
- TLSH T176557011A6F60235E0A6F93069B0520D457A7B25CC63CE1EF644DEDDBBB9972B830237
- MD5 SHA1 SHA512 SSDEEP TLSH