8e2c2b19ba9e353db3f33e03921a4e85b057419bfb14cd2110f18ccdb645c031

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Downloader.Win32.ZippyLoader.dpo.exe
Size 3.1MB
Sample261006-r2laascv5j
SHA256 8e2c2b19ba9e353db3f33e03921a4e85b057419bfb14cd2110f18ccdb645c031
MD5 d37b07dbbc2e0f1bbcfb880c3237b370
SHA1 e78e9231f7f3accbbaa445cb5815fa8cdef357ea
SHA512 623d43294c2b8a7d8d237bb3517a4fb1d38e22e7330c2a66dce2cfcac6624938aba27d0eaae18f083ea034ce73672bceb151de36f730644b378ce6632166e3bb
SSDEEP 49152:jM9FOSQcam4ezAZ5bF+jPPBGM+0/h71KMLr7CM9FOSQcam4ezAZ5bF+jL:jM96AAZaPPNZKMOM96AAZaL
TLSH
T13AE58D4B73E6C1E4DFB381F2C9115222EA717C111B388BDB15E0962EDFA3AA15B36711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2092	Vary.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Vary.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Vary.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2092	2148	jaffacakes118_Trojan-Downloader.Win32.ZippyLoader.dpo.exe	110

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.ZippyLoader.dpo.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.ZippyLoader.dpo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\ProgramData\Vary\Vary.exe
  C:\ProgramData\Vary\Vary.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Vary.exe

Path C:\ProgramData\Vary\Vary.exe
Size 1.0MB
SHA256 31d56b9af806256a21ddf99ce8dfb04a9240dc57188fa3697c0126941770dec3
MD5 4070ef4416ed0c0e55abd14ff5584fe8
SHA1 e0417008d23929368095059566f2c40b8c749567
SHA512 c5993e02d2132421d1c8e9026d309454734e021c359bb699773360478cec1add3a828ba5a5c6d60ffa0c2b95ad9165984c28c3574bab44b049f23aed0ca1c325
SSDEEP 24576:2DaM9FOSQaBabpweGxeezwGkZ5bF+eAIV8Gj:rM9FOSQcam4ezAZ5bF+jy
TLSH
T182358D4B73E6C1E4CFB381F2C9115222EA717C111B388BDB55E0962EDFA3AA15B36711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download