37207eaff115b9509c208cece2b453cad8ef5dde3c648b83ca501dc446a8b1c0

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_37207eaff115b9509c208cece2b453cad8ef5dde3c648b83ca501dc446a8b1c0.exe
Size 689KB
Sample261002-ejdfhsshja
SHA256 37207eaff115b9509c208cece2b453cad8ef5dde3c648b83ca501dc446a8b1c0
MD5 037b3f28e2a2e855f87487305292d427
SHA1 0d2bab4c15037b9380bd257e9c609d7c278756f7
SHA512 e60efd3074f3bd1adfc03e9acc1cc143d5f2ff880ff3957a06c8e533f52eb49dab5d34e2fdb1d0a91fb17009428b6a6ba16e7e146fae07061bef95ba37cc5efb
SSDEEP 12288:abSqs7YQ654NpuaQ79zDcF8w5mwc51+52MMMMMMMMMMMuMMMMMMMMMMMMMMMMMMu:W47/7NpunCt5mw0+52MMMMMMMMMMMuMl
TLSH
T136E4BF906592A0AACEBD4D377E0EEE304F217DF8A111886931DC3D9F79F76B31254292
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5644	securedapp.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	jaffacakes118_37207eaff115b9509c208cece2b453cad8ef5dde3c648b83ca501dc446a8b1c0.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	jaffacakes118_37207eaff115b9509c208cece2b453cad8ef5dde3c648b83ca501dc446a8b1c0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_37207eaff115b9509c208cece2b453cad8ef5dde3c648b83ca501dc446a8b1c0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_37207eaff115b9509c208cece2b453cad8ef5dde3c648b83ca501dc446a8b1c0.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_37207eaff115b9509c208cece2b453cad8ef5dde3c648b83ca501dc446a8b1c0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	securedapp.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4220	jaffacakes118_37207eaff115b9509c208cece2b453cad8ef5dde3c648b83ca501dc446a8b1c0.exe
Token: SeDebugPrivilege	5644	securedapp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
480	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 2452	4220	jaffacakes118_37207eaff115b9509c208cece2b453cad8ef5dde3c648b83ca501dc446a8b1c0.exe	90
PID 480 wrote to memory of 5644	480	explorer.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_37207eaff115b9509c208cece2b453cad8ef5dde3c648b83ca501dc446a8b1c0.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_37207eaff115b9509c208cece2b453cad8ef5dde3c648b83ca501dc446a8b1c0.exe"
1⤵
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" /c select, C:\Users\Admin\AppData\Roaming\securedapp.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2452

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:480
- C:\Users\Admin\AppData\Roaming\securedapp.exe
  "C:\Users\Admin\AppData\Roaming\securedapp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0972B7C417F696E06E186AEB26286F01_660237F1F15C4F37728821BD066D5ECD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0972B7C417F696E06E186AEB26286F01_660237F1F15C4F37728821BD066D5ECD
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

3D0AC26322348780E90E022EA217C58C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3D0AC26322348780E90E022EA217C58C
Size 14KB
SHA256 3367d1950b5815c5790050f9984a26703c4d965bc503a2a47f6d26d87218d1b4
MD5 52ff34bdfacdebe65d10438f911b5e6a
SHA1 e2ca6ab5ec947d459f953361402567ee11e7d48e
SHA512 7a1f439a366c1b1bec4caec7ea31e2436c9b104d6e5d7c3ad5e9532f15ef7ccce1f52a3b9f2efee00ceecf65736562c30f36df1eceb70cd5395e5aee27df20db
SSDEEP 192:UgK+MEJ9CdeOI6ixqo3G18sKgzw0ZpE4YWd9y4DU3AsPvGcka46o9mfYlPzC+L8h:U5+M+9/LHxv3w8XMZpY4DUQnXMu86XrA
TLSH
T197620DDC9C6939D7B045A2B1C88B5EEBCD72B58533D2840AD5A55F014922FCE9EE80F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A3D5BF1283C2E63D8C8A8C72F0051F5A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A3D5BF1283C2E63D8C8A8C72F0051F5A
Size 834B
SHA256 f64b94c786a213df5f80716f98b2e4f90edb77609b43dce1c788792f460a53dd
MD5 6e7576248913afc6faab4229d85e3fcf
SHA1 143ad96b5dbb9c61c0fd5c61c91ca2f60c171624
SHA512 3481f48d977635f480beace91a79752fbc22377239d722cfc6921c63d9cc2ae3bf899c810d37d2939370867c8e323997ddd63a13aa823a6036e5ea332bed0c5c
TLSH
T1E4011E9644083012A4806B24C948ED5FCEB8A39D4FEC9802A0E48D8F5E53FF86B5216A
MD5 SHA1 SHA512 TLSH

Submit Download

0972B7C417F696E06E186AEB26286F01_660237F1F15C4F37728821BD066D5ECD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0972B7C417F696E06E186AEB26286F01_660237F1F15C4F37728821BD066D5ECD
Size 394B
SHA256 eff504898435169e9fcb78bc8599c7b4396bf92afe7de37ecbd23a4cbcb901a6
MD5 0a25cf598376b9287e9fcd4c1887a4da
SHA1 b1c64eee63e2a9710debd78101f373a0e07f2587
SHA512 2f84c99e5aa9b75d26a3189bb8968c93b2d11e4d9a4d4feb633a4fed741a9a10d81243664c461094a36bbba8c02aebdb06f615376a010fa06af194c52361012a
TLSH
T186E0C2142EBD026DF0B0EF7A5ADDE6F54A7EE261590C46E2146027027717900DD61D30
MD5 SHA1 SHA512 TLSH

Submit Download

3D0AC26322348780E90E022EA217C58C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3D0AC26322348780E90E022EA217C58C
Size 170B
SHA256 ad49bf277747f16ee67b690fd4b7d709681fa1fa5c70a7329172fa90e923795b
MD5 ed8347db7400c134edd2d952db73c933
SHA1 ecd7275fb74f774b5d539a20ee5e8a17b0f19e8e
SHA512 ec942e40518423598fc3a2bf5410d24cf7da6f89483cdcc362a86d83834a5cbb67aa0e56d37715e5b6c1ff02cfbc0cfabc89ad14895c7cb83a78c6541a0d7d54
TLSH
T1B5C09B4557594385F1354B3ED74F36147E25550DD952C3C01F70F944457C6289E35982
MD5 SHA1 SHA512 TLSH

Submit Download

8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8828F39C7C0CE9A14B25C7EB321181BA_3DF94EB797096674F7793A562A778C5F
Size 392B
SHA256 3adbf6bdc607a56b2a386efb50e2d95fb57c7722612e612b7dc7d678e9c498fa
MD5 5861196e4ce2d7b9ee2e0e2e6dbe1daf
SHA1 423af25fd5fc77e80c493966b39277fca44a6ca6
SHA512 c7a1626c2d6091c900da381edcd0d77af7d9c9fecf09f699af1be3f6679853fdd266de8d897f7865e36f5804be104710c62a1a876801bfc8d54c1794ecf8817c
TLSH
T1DBE0722808EE02AEF4B49E768BDDA0736906E101985443F140D06302AE13B205CB2830
MD5 SHA1 SHA512 TLSH

Submit Download

A3D5BF1283C2E63D8C8A8C72F0051F5A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A3D5BF1283C2E63D8C8A8C72F0051F5A
Size 178B
SHA256 08839477cfe0b89671c84997d5b3f67bd80aa12e9f3dbab261a055795211bb52
MD5 209c5bbb93fc8ced423d78d8ac10f179
SHA1 5733ccf831f01324fe2d02b2fbc148c17ea4c46d
SHA512 1180d41dda6381dce7557b1fe4774b6553fffa82fa5a4ff0db982ba0bfd553fa097ceb9d3185e0ed028c80cc8ac8de6b2d5d62d1780296b3fb0606f89c02bba5
TLSH
T1B3C02B143756C700E1140F7F000942104F347204E701C3118B3923045C38A10AD3BC02
MD5 SHA1 SHA512 TLSH

Submit Download

securedapp.exe

Path C:\Users\Admin\AppData\Roaming\securedapp.exe
Size 689KB
SHA256 37207eaff115b9509c208cece2b453cad8ef5dde3c648b83ca501dc446a8b1c0
MD5 037b3f28e2a2e855f87487305292d427
SHA1 0d2bab4c15037b9380bd257e9c609d7c278756f7
SHA512 e60efd3074f3bd1adfc03e9acc1cc143d5f2ff880ff3957a06c8e533f52eb49dab5d34e2fdb1d0a91fb17009428b6a6ba16e7e146fae07061bef95ba37cc5efb
SSDEEP 12288:abSqs7YQ654NpuaQ79zDcF8w5mwc51+52MMMMMMMMMMMuMMMMMMMMMMMMMMMMMMu:W47/7NpunCt5mw0+52MMMMMMMMMMMuMl
TLSH
T136E4BF906592A0AACEBD4D377E0EEE304F217DF8A111886931DC3D9F79F76B31254292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

enterprisesec.config.cch.new

Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new
Size 542B
SHA256 e5a4d245b602c1250b9c829c70b76ba78cedab99f4496ccca774487f677be1ec
MD5 ef98fa0d5e737ad3e3c69442e27ca707
SHA1 8d0a12ac36ddf4f82df55d005975ab4051210b37
SHA512 9fa75d123136519f1bae71ad84d118ec95e932eb96fe6ae56fb0b76a4ea22ffa70cce79bf77b1a5f75b735eb7cd305541e6c4de00f9a4bc915738899efafea73
TLSH
T1B3F0A76587EC0152F1F30F3CD1BA65439C347C326D21D65E052B161E4872F52DEA572E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4220-24-0x0000000074972000-0x0000000074974000-memory.dmp

Download

memory/4220-32-0x0000000074970000-0x0000000074F91000-memory.dmp

Download

memory/4220-25-0x0000000074970000-0x0000000074F91000-memory.dmp

Download

memory/4220-23-0x0000000001970000-0x0000000001980000-memory.dmp

Download

memory/4220-1-0x0000000074972000-0x0000000074974000-memory.dmp

Download

memory/4220-22-0x0000000074970000-0x0000000074F91000-memory.dmp

Download

memory/4220-0-0x0000000001970000-0x0000000001980000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads