Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 08:01
Behavioral task
behavioral1
Sample
jaffacakes118_0000f37e06765aaa1a72f3b7e26744268f1067aae969b2a94497fdc0adfbcf4f.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target jaffacakes118_0000f37e06765aaa1a72f3b7e26744268f1067aae969b2a94497fdc0adfbcf4f.exe
- Size 1.3MB
- Sample261006-jws4ysvs5k
- SHA256 0000f37e06765aaa1a72f3b7e26744268f1067aae969b2a94497fdc0adfbcf4f
- MD5 2c21c2e818ce3e73889ad4fb38b39422
- SHA1 55692e23879114fe6bd218f38b11626762e9fa1d
- SHA512 780ca46b883e9c097345f7b3b8e8f93490dabc75d6ea10212f52a21bfe71ab243f960e67826b159c3378f9f68500e3435f600bddc2f412bdfda7eb6884905361
- SSDEEP 12288:hq63Y4bMI2wsNDS5lSsMgQS+CCbLynstu0JLWUktHIiBjBy/+:8kMdwsNDS5lSsjCqnstLyUktHIiLy/+
- TLSH T152557F11A6F60235E0A6F9306AB0520D457A7B25CC63CE1EF640DDDDBBAD972B930237
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Soulclose 3 IoCs
resource yara_rule behavioral2/memory/480-17-0x0000000000400000-0x0000000000424000-memory.dmp family_soulclose behavioral2/memory/4100-18-0x0000000000400000-0x0000000000424000-memory.dmp family_soulclose behavioral2/memory/4100-24-0x0000000000400000-0x0000000000424000-memory.dmp family_soulclose - Executes dropped EXE 1 IoCs
pid Process 4100 CCTV.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ CCTV.exe - Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf CCTV.exe File created C:\autorun.inf CCTV.exe File opened for modification F:\autorun.inf CCTV.exe File created F:\autorun.inf CCTV.exe -
resource yara_rule behavioral2/memory/480-0-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/files/0x000e00000001c51d-9.dat upx behavioral2/memory/480-17-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4100-18-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4100-24-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/files/0x000300000001b6d9-356.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe CCTV.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe CCTV.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe CCTV.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe CCTV.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe CCTV.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE CCTV.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe CCTV.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe CCTV.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe CCTV.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\javaws.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe CCTV.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe CCTV.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe CCTV.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe CCTV.exe File opened for modification C:\Program Files\7-Zip\7z.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe CCTV.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe CCTV.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\CCTV.exe jaffacakes118_0000f37e06765aaa1a72f3b7e26744268f1067aae969b2a94497fdc0adfbcf4f.exe File opened for modification C:\Windows\CCTV.exe jaffacakes118_0000f37e06765aaa1a72f3b7e26744268f1067aae969b2a94497fdc0adfbcf4f.exe File opened for modification C:\Windows\CCTV.exe CCTV.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4848 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_0000f37e06765aaa1a72f3b7e26744268f1067aae969b2a94497fdc0adfbcf4f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCTV.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 480 jaffacakes118_0000f37e06765aaa1a72f3b7e26744268f1067aae969b2a94497fdc0adfbcf4f.exe 4100 CCTV.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 480 wrote to memory of 4848 480 jaffacakes118_0000f37e06765aaa1a72f3b7e26744268f1067aae969b2a94497fdc0adfbcf4f.exe 89 PID 480 wrote to memory of 4100 480 jaffacakes118_0000f37e06765aaa1a72f3b7e26744268f1067aae969b2a94497fdc0adfbcf4f.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0000f37e06765aaa1a72f3b7e26744268f1067aae969b2a94497fdc0adfbcf4f.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0000f37e06765aaa1a72f3b7e26744268f1067aae969b2a94497fdc0adfbcf4f.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0000f37e06765aaa1a72f3b7e26744268f1067aae969b2a94497fdc0adfbcf4fkill.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4848
-
-
C:\Windows\CCTV.exeC:\Windows\CCTV.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4100
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0000f37e06765aaa1a72f3b7e26744268f1067aae969b2a94497fdc0adfbcf4fkill.bat
- Size 280B
- SHA256 06195f52056074fdf57b98c36377667d9af568475cedc135558e7349ce4e5458
- MD5 a6d4f0682d8c4b399bcb741071d4ac8e
- SHA1 b1bfd3e0dba78169cfb0c98e5cc9cc7faaa2f752
- SHA512 862399b3efdaf00978bdcd998bb236c3d8ebce38f3f8b846c0c26e0c99b55ba84d309e28f429e9271f9217519875ed74f1118a9f536a374c94bbf2c82ed0ea90
- TLSH T126D02B8C40F79E756C58E46F01FC1709B1953A1B32D74E105F3540CC2AD3016B687309
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\MeasureResize.exe
- Size 1.9MB
- SHA256 48da03c98d948244bdcd3bc4193674be5ce8fac55f978fcf036c002e3fc8b12d
- MD5 e0c69c324204699f026b3741066c7483
- SHA1 4b2c5d05c15c608a803f30044756ff674c8012ba
- SHA512 d6ceb9a6968a1f3be3aaf75a0ee7925f804d28fc867d16ba1d4434abd8178ebbbe050972694525f51b3ef16c427702e9e2c3d5965258cd197c85c68d4384dc0f
- SSDEEP 49152:yusNDS5lSHqnstLet3Ly/wP0bBzjIz89pLVFL:yjNDS5lSHqnstLE8Jbpp9pH
- TLSH T12A951711A6F60235E0A6F9306AB0520D457A7B25CC63CE1EF640DDDDBBAD972B930237
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\CCTV.exe
- Size 1.3MB
- SHA256 0000f37e06765aaa1a72f3b7e26744268f1067aae969b2a94497fdc0adfbcf4f
- MD5 2c21c2e818ce3e73889ad4fb38b39422
- SHA1 55692e23879114fe6bd218f38b11626762e9fa1d
- SHA512 780ca46b883e9c097345f7b3b8e8f93490dabc75d6ea10212f52a21bfe71ab243f960e67826b159c3378f9f68500e3435f600bddc2f412bdfda7eb6884905361
- SSDEEP 12288:hq63Y4bMI2wsNDS5lSsMgQS+CCbLynstu0JLWUktHIiBjBy/+:8kMdwsNDS5lSsjCqnstLyUktHIiLy/+
- TLSH T152557F11A6F60235E0A6F9306AB0520D457A7B25CC63CE1EF640DDDDBBAD972B930237
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\autorun.inf
- Size 26B
- SHA256 94f4f532c5d13217e9b0cf2706ea143cf51bfe83fbe62ba3c033469bbf83802f
- MD5 36812730603173b6ebe5cf22938e3e92
- SHA1 9b262a885e488c9e51b61a7a8d741225355b636d
- SHA512 6e2cf9a92ae462996b1ff6a6b202409178422afc0e5bb4794eb6ca4e8bda07f5fc8e5b143efcb7bf4cc08112c057ad3ae4a8d065cc7729757e22bc9c93da81fd
- MD5 SHA1 SHA512