7dcba99f083b62841fb1b73e3697bc096e32cc19a6d2a9be2bd92960a630e5da

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_7dcba99f083b62841fb1b73e3697bc096e32cc19a6d2a9be2bd92960a630e5da.exe
Size 122KB
Sample260924-2la5haytct
SHA256 7dcba99f083b62841fb1b73e3697bc096e32cc19a6d2a9be2bd92960a630e5da
MD5 7761a05e2b3a5e6e6145a50c83ba91a4
SHA1 90808e6c2ad67c1f98b4ee74eb2484b1ec6020f5
SHA512 6d53e646bed3893e8d698a2ebff9243f64888be91399433826b16fa9e8a172cf452332ea6faa936135b84d0d7a5901abd66d52a13c16eb0822cfddde9123a9fc
SSDEEP 3072:3mqOW8BHQKxPysFPVr59HqTM8Fg0GkcNanc/FSs:2qDaRxZFPt5V2M8FgnNanc/F
TLSH
T168C3D01E76E0C531E48480F00B7D4F73EB7E652C0652436B5B98A469AFB4253FA0A37B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	jaffacakes118_7dcba99f083b62841fb1b73e3697bc096e32cc19a6d2a9be2bd92960a630e5da.exe

Executes dropped EXE 17 IoCs

pid	Process
3544	cvvvpaqnt.exe
2492	MsSvc32.exe
1748	MsSvc32.exe
4080	MsSvc32.exe
5104	MsSvc32.exe
1336	MsSvc32.exe
2764	MsSvc32.exe
4808	MsSvc32.exe
3900	MsSvc32.exe
2656	MsSvc32.exe
1644	MsSvc32.exe
3412	MsSvc32.exe
4064	MsSvc32.exe
5060	MsSvc32.exe
2724	MsSvc32.exe
5064	MsSvc32.exe
3208	MsSvc32.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	cvvvpaqnt.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	cvvvpaqnt.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	cvvvpaqnt.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe
File created	C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe	MsSvc32.exe
File opened for modification	C:\Windows\SysWOW64\WinSvc32	MsSvc32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvvvpaqnt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_7dcba99f083b62841fb1b73e3697bc096e32cc19a6d2a9be2bd92960a630e5da.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsSvc32.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3544	cvvvpaqnt.exe
3544	cvvvpaqnt.exe
2492	MsSvc32.exe
2492	MsSvc32.exe
1748	MsSvc32.exe
1748	MsSvc32.exe
4080	MsSvc32.exe
4080	MsSvc32.exe
5104	MsSvc32.exe
5104	MsSvc32.exe
1336	MsSvc32.exe
1336	MsSvc32.exe
2764	MsSvc32.exe
2764	MsSvc32.exe
4808	MsSvc32.exe
4808	MsSvc32.exe
3900	MsSvc32.exe
3900	MsSvc32.exe
2656	MsSvc32.exe
2656	MsSvc32.exe
1644	MsSvc32.exe
1644	MsSvc32.exe
3412	MsSvc32.exe
3412	MsSvc32.exe
4064	MsSvc32.exe
4064	MsSvc32.exe
5060	MsSvc32.exe
5060	MsSvc32.exe
2724	MsSvc32.exe
2724	MsSvc32.exe
5064	MsSvc32.exe
5064	MsSvc32.exe
3208	MsSvc32.exe
3208	MsSvc32.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 3544	4512	jaffacakes118_7dcba99f083b62841fb1b73e3697bc096e32cc19a6d2a9be2bd92960a630e5da.exe	87
PID 3544 wrote to memory of 2492	3544	cvvvpaqnt.exe	91
PID 2492 wrote to memory of 1748	2492	MsSvc32.exe	96
PID 1748 wrote to memory of 4080	1748	MsSvc32.exe	98
PID 4080 wrote to memory of 5104	4080	MsSvc32.exe	102
PID 5104 wrote to memory of 1336	5104	MsSvc32.exe	103
PID 1336 wrote to memory of 2764	1336	MsSvc32.exe	105
PID 2764 wrote to memory of 4808	2764	MsSvc32.exe	106
PID 4808 wrote to memory of 3900	4808	MsSvc32.exe	107
PID 3900 wrote to memory of 2656	3900	MsSvc32.exe	109
PID 2656 wrote to memory of 1644	2656	MsSvc32.exe	110
PID 1644 wrote to memory of 3412	1644	MsSvc32.exe	111
PID 3412 wrote to memory of 4064	3412	MsSvc32.exe	113
PID 4064 wrote to memory of 5060	4064	MsSvc32.exe	114
PID 5060 wrote to memory of 2724	5060	MsSvc32.exe	115
PID 2724 wrote to memory of 5064	2724	MsSvc32.exe	116
PID 5064 wrote to memory of 3208	5064	MsSvc32.exe	117

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7dcba99f083b62841fb1b73e3697bc096e32cc19a6d2a9be2bd92960a630e5da.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7dcba99f083b62841fb1b73e3697bc096e32cc19a6d2a9be2bd92960a630e5da.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Users\Admin\AppData\Local\Temp\cvvvpaqnt.exe
  "C:\Users\Admin\AppData\Local\Temp\cvvvpaqnt.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
    C:\Windows\system32\WinSvc32\MsSvc32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
      C:\Windows\system32\WinSvc32\MsSvc32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1748
    - - C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4080
      - C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1336
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2764
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3412
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\Windows\SysWOW64\WinSvc32\MsSvc32.exe
        
        C:\Windows\system32\WinSvc32\MsSvc32.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cvvvpaqnt.exe

Path C:\Users\Admin\AppData\Local\Temp\cvvvpaqnt.exe
Size 74KB
SHA256 cfca891ba7752f123f580adf886629ae42bac40fd9f4c26a0dc6d1e019b7fcf3
MD5 064ec0e02aff819c09e1ac120b3fb1ab
SHA1 e9d814871d1e174fd4a19fcd238fd0e4444c6a37
SHA512 72d360ad501724e2275fe758dfb0108cd5e58fea32f76f4252c1d5417aa32f4244e81c1a82d3c6fe207b41017f293dc3345a17aad2a08e8496e7859f420b960e
SSDEEP 1536:s3iBemo5PK+dTGq5X0u8iQHp1b48weg0GwMzQrzoN7xcncFlFSH:bsFPVr59HqTM8Fg0GkcNanc/FSH
TLSH
T1B873018D03A10A94D8D8817603AA8FD5D7AAB43D5D4A0B2B5D14406E7B3C347BB86F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1336-34-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1644-52-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1748-23-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2492-20-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2656-49-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2724-68-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2724-65-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2764-37-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3208-73-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3412-53-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3412-56-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3544-17-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3544-11-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3900-42-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/3900-46-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4064-60-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4064-57-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4080-27-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4080-24-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4512-43-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4808-41-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4808-38-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5060-61-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5060-64-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5064-69-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5064-71-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5104-31-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/5104-28-0x0000000000400000-0x0000000000447000-memory.dmp

Download