b2ad15de6a117e544e2ca5094daf3a86f45884db4ae44c35da3b0eb987d06038

Analysis

max time kernel
150s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_b2ad15de6a117e544e2ca5094daf3a86f45884db4ae44c35da3b0eb987d06038.exe
Size 997KB
Sample260930-lvdc8aca77
SHA256 b2ad15de6a117e544e2ca5094daf3a86f45884db4ae44c35da3b0eb987d06038
MD5 d92bb804e2b4b7a3956c5ddfd7f53dc3
SHA1 0d494c719a652b2b72d5902d1d285bdfb7451332
SHA512 88ba322d17dad305992ba65dc7edbe1167576c8b4fe0cd9fff4a02405f3f533702ad13b2b661530ddc51ad154930782babea07269c39936d19f9fdab626f88f9
SSDEEP 6144:EJz/YprV2TXzt2ui1jUspV3yRR1poY/92tfxdcbB2CbvnJfCPYJJJ:eYBV2TXYhpJwR1pS+B2CLnCYJJJ
TLSH
T10025F1853705189FC6F8DAB3C1439E82E4434765A439BAE90D516A0EF9F938FEF94603
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery execution persistence spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4620	osoti.exe
4440	osoti.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{D523EE4F-556D-BCA0-F8D8-F90E352DE30C} = "C:\\Users\\Admin\\AppData\\Roaming\\Meobad\\osoti.exe"	osoti.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5008 set thread context of 4640	5008	jaffacakes118_b2ad15de6a117e544e2ca5094daf3a86f45884db4ae44c35da3b0eb987d06038.exe	89

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4640	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_b2ad15de6a117e544e2ca5094daf3a86f45884db4ae44c35da3b0eb987d06038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	osoti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	jaffacakes118_b2ad15de6a117e544e2ca5094daf3a86f45884db4ae44c35da3b0eb987d06038.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Privacy	jaffacakes118_b2ad15de6a117e544e2ca5094daf3a86f45884db4ae44c35da3b0eb987d06038.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe
4620	osoti.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5008	jaffacakes118_b2ad15de6a117e544e2ca5094daf3a86f45884db4ae44c35da3b0eb987d06038.exe
Token: SeSecurityPrivilege	5008	jaffacakes118_b2ad15de6a117e544e2ca5094daf3a86f45884db4ae44c35da3b0eb987d06038.exe
Token: SeSecurityPrivilege	5008	jaffacakes118_b2ad15de6a117e544e2ca5094daf3a86f45884db4ae44c35da3b0eb987d06038.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4620	5008	jaffacakes118_b2ad15de6a117e544e2ca5094daf3a86f45884db4ae44c35da3b0eb987d06038.exe	88
PID 4620 wrote to memory of 2236	4620	osoti.exe	51
PID 4620 wrote to memory of 1208	4620	osoti.exe	52
PID 4620 wrote to memory of 700	4620	osoti.exe	53
PID 4620 wrote to memory of 3220	4620	osoti.exe	55
PID 4620 wrote to memory of 3416	4620	osoti.exe	57
PID 4620 wrote to memory of 3608	4620	osoti.exe	58
PID 4620 wrote to memory of 3700	4620	osoti.exe	59
PID 4620 wrote to memory of 3776	4620	osoti.exe	60
PID 4620 wrote to memory of 3860	4620	osoti.exe	61
PID 4620 wrote to memory of 4020	4620	osoti.exe	62
PID 4620 wrote to memory of 4632	4620	osoti.exe	65
PID 4620 wrote to memory of 3172	4620	osoti.exe	78
PID 4620 wrote to memory of 2300	4620	osoti.exe	85
PID 4620 wrote to memory of 3920	4620	osoti.exe	86
PID 4620 wrote to memory of 5008	4620	osoti.exe	87
PID 5008 wrote to memory of 4640	5008	jaffacakes118_b2ad15de6a117e544e2ca5094daf3a86f45884db4ae44c35da3b0eb987d06038.exe	89
PID 5008 wrote to memory of 4640	5008	jaffacakes118_b2ad15de6a117e544e2ca5094daf3a86f45884db4ae44c35da3b0eb987d06038.exe	89
PID 4620 wrote to memory of 1620	4620	osoti.exe	94
PID 4620 wrote to memory of 2556	4620	osoti.exe	95
PID 4620 wrote to memory of 3716	4620	osoti.exe	96
PID 4620 wrote to memory of 3372	4620	osoti.exe	112

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:1208

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:700

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3220
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b2ad15de6a117e544e2ca5094daf3a86f45884db4ae44c35da3b0eb987d06038.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b2ad15de6a117e544e2ca5094daf3a86f45884db4ae44c35da3b0eb987d06038.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Users\Admin\AppData\Roaming\Meobad\osoti.exe
    "C:\Users\Admin\AppData\Roaming\Meobad\osoti.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4620
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp4689f066.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3416

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3608

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3700

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3776

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3860

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4020

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4632

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:3172

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:2300

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3920

C:\Users\Admin\AppData\Roaming\Meobad\osoti.exe
C:\Users\Admin\AppData\Roaming\Meobad\osoti.exe
1⤵
- Executes dropped EXE
PID:4440

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1620

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2556

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:3716

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp4689f066.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp4689f066.bat
Size 335B
SHA256 be0a6707f9e925eac64de9dc9377e0e4b67efd66191eb74ceff13f4dc21eb55b
MD5 9b830395219b5221936734e9efec1cd9
SHA1 df4863525fd7008ce0c1459333f775f2b0b9e41e
SHA512 a755841fc7e1586e4e369bb0bf0e59a33fabce3ea83099123e75eca42da81d40ea37f4f6bd0edb59769fd6cf3231d4da017ebf47d8fcfc758e17769371dcc552
TLSH
T11DE0D8EA1582955D080DD4278975214E607F44753E89FB211371CF8E219902CB1C7705
MD5 SHA1 SHA512 TLSH

Submit Download

osoti.exe

Path C:\Users\Admin\AppData\Roaming\Meobad\osoti.exe
Size 997KB
SHA256 cc5d41d92bc0d1b85aaf5df094d59ad05554e96c0afdef8a220a4fd1ff275f0a
MD5 ee3a53d579b53bb41f82ad5d0a573aac
SHA1 c21a44b6a5fe350608a3a0fe946d21fa32f292ef
SHA512 14e8cd43bf9c9006ce6d38cbd5409362d872e4460232de0c6f4e1e71bf84760bf7163a51a75f7f408c144cb67083451252bd2c64dea2e6b745d2862c9f17f3f2
SSDEEP 6144:EJz/YprV2TXzt2ui1jUspV3yRR1poY/92tfxdcbB2CbvnJfCPYJJJ:eYBV2TXYhpJwR1pS+B2CLnCYJJJ
TLSH
T19125E1853706189FC6F8DAB3C1439E82E4430765A439B6E90D516A0EF9F938FEF94603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wodo.ont

Path C:\Users\Admin\AppData\Roaming\Yqnona\wodo.ont
Size 412B
SHA256 1bc397dc81c964d1f90d85e11344943822c3c9026e636673f909c2fa14b72493
MD5 73b1637aa0b3f5b0ceb8dbc1d6ea6096
SHA1 94fc799a33384a44946035b9ec993cc8bde4c7e2
SHA512 f0fe707af5ae153934ee8f5a302edb9a99469408997490bb160d66500d2565192a1511d4188c4189accf42bc555f245d4e33b96b78e1c986e76ff9342af622f3
TLSH
T1D3E0AB91505AE762C28B52C33183620053FCD84D0052FD1378E760880A52C71F2CB475
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4440-23-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/4620-33-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/4620-35-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/4620-24-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/4620-36-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/4620-32-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/4620-31-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/4620-29-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/4620-7-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/4620-28-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/4620-26-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/4620-38-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/4640-20-0x0000000000980000-0x00000000009C1000-memory.dmp

Download

memory/4640-19-0x0000000000980000-0x00000000009C1000-memory.dmp

Download

memory/4640-17-0x0000000000980000-0x00000000009C1000-memory.dmp

Download

memory/5008-0-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/5008-14-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/5008-15-0x0000000000400000-0x0000000000531000-memory.dmp

Download

memory/5008-11-0x0000000000830000-0x0000000000871000-memory.dmp

Download

memory/5008-9-0x0000000000830000-0x0000000000871000-memory.dmp

Download

memory/5008-8-0x0000000000830000-0x0000000000871000-memory.dmp

Download

memory/5008-1-0x0000000000410000-0x0000000000411000-memory.dmp

Download