f6ddc20dfe4b0a0814936444fb3970b412ae7b308b8404f8c13f4ae122b719d8

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.MSIL.Crypt.fiou.exe
Size 401KB
Sample261006-vszywasvdt
SHA256 f6ddc20dfe4b0a0814936444fb3970b412ae7b308b8404f8c13f4ae122b719d8
MD5 ac76569843aaa8133fc86fdd95a85cf2
SHA1 38b29e61d59cd977b6b1f1ad069fb4e61ea6859f
SHA512 1affe508ecf2f1e29feb41bfcc805c7613c63308f8186110d500c8361ba59204409c52533b4392a053f2c98ca1b37d7ef41353afb63f63f1b8ae5c4e4fc0c74f
SSDEEP 6144:9d4PHeuTF0YimILdWSNqrlVh2HinHlY95YvXZP2rgo6hHyA5+pm5F5qfxW+mfw:9ieCZimgDNqr5ui+Qp+rgRNyA55IxJM
TLSH
T14494135137F8473FC4E8477758665A882DBD9C157E23DB2A7CD2C2C84D62B8CB202B68
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
5260	wecutil.exe
5172	wecutil.exe
2068	wecutil.exe
2376	wecutil.exe
4768	wecutil.exe
5704	wecutil.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wecutil.exe
Key opened	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wecutil.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\wecutil.exe"	jaffacakes118_Trojan.MSIL.Crypt.fiou.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	checkip.dyndns.org

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5260 set thread context of 2068	5260	wecutil.exe	94
PID 5172 set thread context of 2376	5172	wecutil.exe	95
PID 2068 set thread context of 4768	2068	wecutil.exe	96
PID 2376 set thread context of 5704	2376	wecutil.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wecutil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wecutil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wecutil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wecutil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wecutil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wecutil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wecutil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wecutil.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wecutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wecutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wecutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wecutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.MSIL.Crypt.fiou.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wecutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wecutil.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5020	jaffacakes118_Trojan.MSIL.Crypt.fiou.exe
5020	jaffacakes118_Trojan.MSIL.Crypt.fiou.exe
5020	jaffacakes118_Trojan.MSIL.Crypt.fiou.exe
5020	jaffacakes118_Trojan.MSIL.Crypt.fiou.exe
5020	jaffacakes118_Trojan.MSIL.Crypt.fiou.exe
5020	jaffacakes118_Trojan.MSIL.Crypt.fiou.exe
5260	wecutil.exe
5260	wecutil.exe
5260	wecutil.exe
5260	wecutil.exe
5260	wecutil.exe
5260	wecutil.exe
5172	wecutil.exe
5172	wecutil.exe
5172	wecutil.exe
5172	wecutil.exe
5172	wecutil.exe
5172	wecutil.exe
5704	wecutil.exe
4768	wecutil.exe
5704	wecutil.exe
4768	wecutil.exe
5704	wecutil.exe
5704	wecutil.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5020	jaffacakes118_Trojan.MSIL.Crypt.fiou.exe
Token: SeDebugPrivilege	5260	wecutil.exe
Token: SeDebugPrivilege	5172	wecutil.exe
Token: SeDebugPrivilege	2068	wecutil.exe
Token: SeDebugPrivilege	2376	wecutil.exe
Token: SeDebugPrivilege	4768	wecutil.exe
Token: SeDebugPrivilege	5704	wecutil.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4768	wecutil.exe
5704	wecutil.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 5172	5020	jaffacakes118_Trojan.MSIL.Crypt.fiou.exe	91
PID 5260 wrote to memory of 2068	5260	wecutil.exe	94
PID 5260 wrote to memory of 2068	5260	wecutil.exe	94
PID 5260 wrote to memory of 2068	5260	wecutil.exe	94
PID 5260 wrote to memory of 2068	5260	wecutil.exe	94
PID 5260 wrote to memory of 2068	5260	wecutil.exe	94
PID 5172 wrote to memory of 2376	5172	wecutil.exe	95
PID 5172 wrote to memory of 2376	5172	wecutil.exe	95
PID 5172 wrote to memory of 2376	5172	wecutil.exe	95
PID 5172 wrote to memory of 2376	5172	wecutil.exe	95
PID 5172 wrote to memory of 2376	5172	wecutil.exe	95
PID 2068 wrote to memory of 4768	2068	wecutil.exe	96
PID 2068 wrote to memory of 4768	2068	wecutil.exe	96
PID 2068 wrote to memory of 4768	2068	wecutil.exe	96
PID 2068 wrote to memory of 4768	2068	wecutil.exe	96
PID 2068 wrote to memory of 4768	2068	wecutil.exe	96
PID 2376 wrote to memory of 5704	2376	wecutil.exe	97
PID 2376 wrote to memory of 5704	2376	wecutil.exe	97
PID 2376 wrote to memory of 5704	2376	wecutil.exe	97
PID 2376 wrote to memory of 5704	2376	wecutil.exe	97
PID 2376 wrote to memory of 5704	2376	wecutil.exe	97

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wecutil.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wecutil.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.MSIL.Crypt.fiou.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.MSIL.Crypt.fiou.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\wecutil.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\wecutil.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5172
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\wecutil.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\wecutil.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\wecutil.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\wecutil.exe"
      4⤵
      Executes dropped EXE
      Accesses Microsoft Outlook profiles
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      outlook_office_path
      outlook_win_path
      PID:5704

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\wecutil.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\wecutil.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5260
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\wecutil.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\wecutil.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\wecutil.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\wecutil.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 e69b1c9ad079743da2721a8dde1a74d91806d649d5464806da24b6cf6f80ae45
MD5 93fc0eb4c38a04447e91d6f5a8ab4232
SHA1 11c6a2252b11f7eb3f9a9130d9881a54d2958ab6
SHA512 d165692ca7a12024fbce9173b1d031b7cf79ff0aafb2c5e3301271c41d6f1b951df70f0326d18b6c7a30374a9927526c91596b60b2c502ca50dba5e4152490ee
TLSH
T19EE086113AB80108E5330A3C6A73A844593773275D01CADD0734018D0C24FA18D76219
MD5 SHA1 SHA512 TLSH

Submit Download

wecutil.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\wecutil.exe
Size 410KB
SHA256 39199d71ae7ba26e7d3ea43bed1f608a42f2524abc52084176dba067385b20a1
MD5 66f168f71c7220561125c8d92bc63d1c
SHA1 0ee77c50beb331b711bb96a10280fa2a5727655e
SHA512 ddfd0797f01b8af223c942301334137f7478795281dd3d7e603f97114500241586f362ef94fb0b82c41da55af8250712a945020a11104df0bfb92aa673371fc7
SSDEEP 12288:kieCZimgDNqr5ui+Qp+rgRNyA55IxJMY1:kieU8k+QpugRNJID
TLSH
T15994129137FC472FC4E85B7244659A843DBD99163E23DB2A3CD6C2D80D52BCCB202B68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Waiting.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Waiting.txt
Size 32B
SHA256 5f93ab29e865f7f9393aacbf81492bfb1372b8a8c1fb025100a713c2b3512548
MD5 53655d327a827e35b1884a5790a61406
SHA1 7a0fe0738a28cca13bae9621583e52bf61fce7de
SHA512 cb710ce4bee5daa2420eab94ff94735ae8f4d57244c6176ec517ed4e97417ca250ea5045fad1f247b3c9fd00f2ea5bb22ce0d58c4e0c17e936d653ae30071bcc
MD5 SHA1 SHA512

Submit Download

memory/2068-35-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/4768-42-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/5020-5-0x0000000074722000-0x0000000074724000-memory.dmp

Download

memory/5020-6-0x0000000074720000-0x0000000074D41000-memory.dmp

Download

memory/5020-1-0x0000000074722000-0x0000000074724000-memory.dmp

Download

memory/5020-25-0x0000000074720000-0x0000000074D41000-memory.dmp

Download

memory/5020-4-0x0000000001490000-0x00000000014A0000-memory.dmp

Download

memory/5020-3-0x0000000074720000-0x0000000074D41000-memory.dmp

Download

memory/5020-2-0x0000000074720000-0x0000000074D41000-memory.dmp

Download

memory/5020-0-0x0000000001490000-0x00000000014A0000-memory.dmp

Download

memory/5172-22-0x0000000074720000-0x0000000074D41000-memory.dmp

Download

memory/5172-23-0x0000000074720000-0x0000000074D41000-memory.dmp

Download

memory/5172-32-0x0000000074720000-0x0000000074D41000-memory.dmp

Download

memory/5172-46-0x0000000074720000-0x0000000074D41000-memory.dmp

Download

memory/5260-24-0x0000000074720000-0x0000000074D41000-memory.dmp

Download

memory/5260-41-0x0000000074720000-0x0000000074D41000-memory.dmp

Download

memory/5260-33-0x0000000074720000-0x0000000074D41000-memory.dmp

Download