2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe
Size 1.3MB
Sample260930-npp6yaec43
SHA256 2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd
MD5 a9036d1ff323b7bf41916385ded91ca7
SHA1 1c8112b78419c6a68fe27934b08bd656b0832b2d
SHA512 4d1935012b4a0bdee86a89754e9b18bbc239d637e8c1a4f063faf44a5297fe6efe4b8465c38a4dc9690ecd93b667862cc9e0400c35b8e33fb5fd9e9925a0a482
SSDEEP 24576:pEmX97HmuiXoWMEFh1OUW5QbortGM1X0hCPS1p8RRbR6L1TKIET7uTpO:pEmNni/KtGquCq722TuTaTpO
TLSH
T147556C26F292C037D1731A359C5BC2D9D836BF242D68984B7BE41F0C5F397827A252E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	svchost.exe
File created	C:\Windows\system32\drivers\etc\hîsts	svchost.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4160	netsh.exe

Executes dropped EXE 3 IoCs

pid	Process
3308	svchost.exe
4592	svchost.exe
2640	svchost.exe

Unexpected DNS network traffic destination 6 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	13	208.67.222.222	2640	svchost.exe
Destination IP	8	208.67.222.222	2640	svchost.exe
Destination IP	9	208.67.222.222	2640	svchost.exe
Destination IP	10	208.67.222.222	2640	svchost.exe
Destination IP	11	208.67.222.222	2640	svchost.exe
Destination IP	12	208.67.222.222	2640	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe\""	jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe\""	jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\update.2\	svchost.exe
File opened for modification	C:\Windows\update.2\	jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe
File created	C:\Windows\update.2\svchost.exe	jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe
File opened for modification	C:\Windows\update.2\	jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe
File created	C:\Windows\update.2\svchost.exe	jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe
File opened for modification	C:\Windows\update.2\	svchost.exe
File opened for modification	C:\Windows\update.2\svchost.exe	jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe
File opened for modification	C:\Windows\update.2\	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netstat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3484	netstat.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3484	netstat.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2640	svchost.exe
2640	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3484	netstat.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5620	jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe
4280	jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe
3308	svchost.exe
4592	svchost.exe
2640	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 2640	4592	svchost.exe	93
PID 2640 wrote to memory of 4160	2640	svchost.exe	94
PID 2640 wrote to memory of 3484	2640	svchost.exe	98

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5620

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4280

C:\Windows\update.2\svchost.exe
C:\Windows\update.2\svchost.exe srv
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3308

C:\Windows\update.2\svchost.exe
C:\Windows\update.2\svchost.exe srv
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\update.2\svchost.exe
  "C:\Windows\update.2\svchost.exe" stand
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Unexpected DNS network traffic destination
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\netsh.exe
    "C:\Windows\System32\netsh.exe" firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4160
- - C:\Windows\SysWOW64\netstat.exe
    netstat -ano
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:3484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Windows\update.2\svchost.exe
Size 1.3MB
SHA256 2d297297dc999e8d12b7ffc0dfac5939db050b190fc5e3da3cefb75be04883fd
MD5 a9036d1ff323b7bf41916385ded91ca7
SHA1 1c8112b78419c6a68fe27934b08bd656b0832b2d
SHA512 4d1935012b4a0bdee86a89754e9b18bbc239d637e8c1a4f063faf44a5297fe6efe4b8465c38a4dc9690ecd93b667862cc9e0400c35b8e33fb5fd9e9925a0a482
SSDEEP 24576:pEmX97HmuiXoWMEFh1OUW5QbortGM1X0hCPS1p8RRbR6L1TKIET7uTpO:pEmNni/KtGquCq722TuTaTpO
TLSH
T147556C26F292C037D1731A359C5BC2D9D836BF242D68984B7BE41F0C5F397827A252E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2640-33-0x0000000000400000-0x0000000000B66000-memory.dmp

Download

memory/2640-36-0x0000000000400000-0x0000000000B66000-memory.dmp

Download

memory/2640-31-0x0000000000400000-0x0000000000B66000-memory.dmp

Download

memory/2640-29-0x0000000000400000-0x0000000000B66000-memory.dmp

Download

memory/2640-27-0x0000000000400000-0x0000000000B66000-memory.dmp

Download

memory/2640-17-0x0000000000400000-0x0000000000B66000-memory.dmp

Download

memory/2640-25-0x0000000000400000-0x0000000000B66000-memory.dmp

Download

memory/3308-4-0x0000000000400000-0x0000000000B66000-memory.dmp

Download

memory/3308-5-0x0000000000400000-0x0000000000B66000-memory.dmp

Download

memory/4280-2-0x0000000000400000-0x0000000000B66000-memory.dmp

Download

memory/4280-24-0x0000000000400000-0x0000000000B66000-memory.dmp

Download

memory/4280-10-0x0000000000400000-0x0000000000B66000-memory.dmp

Download

memory/4592-14-0x0000000000400000-0x0000000000B66000-memory.dmp

Download

memory/4592-26-0x0000000000400000-0x0000000000B66000-memory.dmp

Download

memory/4592-9-0x0000000000400000-0x0000000000B66000-memory.dmp

Download

memory/5620-22-0x0000000000400000-0x0000000000B66000-memory.dmp

Download

memory/5620-1-0x0000000000B3F000-0x0000000000B40000-memory.dmp

Download

memory/5620-7-0x0000000000400000-0x0000000000B66000-memory.dmp

Download

memory/5620-6-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/5620-0-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download