7cbe6e0e27c43a46d705dd86d03c1eca5890ceebc9e2eb5dbda06615c2fd4ba4

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Delf.ab.exe
Size 92KB
Sample261009-wmax8sdc65
SHA256 7cbe6e0e27c43a46d705dd86d03c1eca5890ceebc9e2eb5dbda06615c2fd4ba4
MD5 9b1cac1372875adac79380652ed5af6b
SHA1 458564e161f784e167d7427225335176d50a4ec3
SHA512 de481c629f8846c16f833f67e3d72ad079f92ddef352b672b6c5be78ca64ea4a65310c0aff342c2ce9617c0061230e859625506a6da3a78f2f4140dcb53cf938
SSDEEP 1536:gZSqzS/1sYCDZeSoFr8pTTign/Hx8d22gX5ieNq5tQQW6zyXHzWisgjZWeT1GcjM:sS/1cDZ7Ar8pd1HGQQVuTJPFT1GcX
TLSH
T11493CF6E75799BB1C490D1BCCF6E91FCBEA394A7740A396564433BCA5CBE3400A068C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan-Dropper.Win32.Delf.ab.exe

Executes dropped EXE 2 IoCs

pid	Process
4168	~DPBD70.exe
1724	iexplore.exe

Loads dropped DLL 7 IoCs

pid	Process
4168	~DPBD70.exe
4168	~DPBD70.exe
4168	~DPBD70.exe
1724	iexplore.exe
1724	iexplore.exe
1724	iexplore.exe
1724	iexplore.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Iexplore Services = "iexplore.exe"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Iexplore Services = "iexplore.exe"	iexplore.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\v_ca32.dll	~DPBD70.exe
File created	C:\Windows\SysWOW64\v_in32.dll	~DPBD70.exe
File created	C:\Windows\SysWOW64\iexplore.exe	~DPBD70.exe
File opened for modification	C:\Windows\SysWOW64\iexplore.exe	~DPBD70.exe
File opened for modification	C:\Windows\SysWOW64\v_ca32.dll	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\v_in32.dll	iexplore.exe
File created	C:\Windows\SysWOW64\iexplore.exe	iexplore.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	iexplore.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Delf.ab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~DPBD70.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	~DPBD70.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	~DPBD70.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	iexplore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	iexplore.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4168	~DPBD70.exe
Token: SeShutdownPrivilege	4168	~DPBD70.exe
Token: SeSecurityPrivilege	1724	iexplore.exe
Token: SeShutdownPrivilege	1724	iexplore.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 4168	3296	jaffacakes118_Trojan-Dropper.Win32.Delf.ab.exe	88
PID 4168 wrote to memory of 1724	4168	~DPBD70.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Delf.ab.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Delf.ab.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Users\Admin\AppData\Local\Temp\~DPBD70.exe
  "C:\Users\Admin\AppData\Local\Temp\~DPBD70.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\iexplore.exe
    "C:\Users\Admin\AppData\Local\Temp\~DPBD70.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:1724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~DPBD70.exe

Path C:\Users\Admin\AppData\Local\Temp\~DPBD70.exe
Size 57KB
SHA256 44535437e72cef56699e0936e1234f0f3cf0109a73148906ff3ced6fcb9dee57
MD5 326b867fb3f4c28f8566ebeb46086dab
SHA1 7be61565063e681a34df199c8bb0005a10521130
SHA512 1ca38048ed52157d24e6e90ccda7ba14520e745bf9145704b7234d4e163b0cb8bc20513f630256b5b4a3700757b6f8e90cf6718b97e029265d8afdffed9bcdc1
SSDEEP 1536:kgn/Hx8d22gX5ieNq5tQQW6zyXHzWisgjZWeT1GcjDo+:n1HGQQVuTJPFT1GcXz
TLSH
T165438BADA57E57B9C952E27CCFAD65EDBDA780D7B01A2C64604353E74C9F2804242CC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v_ca32.dll

Path C:\Windows\SysWOW64\v_ca32.dll
Size 15KB
SHA256 ea0caec63d1f385382aa4fed6ff61fbf729677abc4af9e6b68fea4e5f4cbd83f
MD5 05974d013ae060409aa2d89e7f00545d
SHA1 2d5ac6bb0af09cbf031dd9c482b90669b8826e3a
SHA512 b80d5345ba10779470d0f16bb7052a4e02fd8556b550791e542f9229ea8d23f6b5aaf3439b049efcaed179324f48e4d033cb12a342f42cab2c8afc4bfa77d236
SSDEEP 384:RkxP7dHESi9PkN3yzNda1IuMPUZf96ggY:R2+SykN3YNdaT2u6xY
TLSH
T17162C0FEAD9D3C34F1FAF7351AAD5818E626881E356B0094099ABC303568A9018C7E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v_in32.dll

Path C:\Windows\SysWOW64\v_in32.dll
Size 12KB
SHA256 37b5c455e1b17406077f2e896c900b29d4350f8288fe4a7fc345cc1cb9321a91
MD5 81d79ec94b92f5081a5c7c89ab9a880a
SHA1 add4f4bdc36e7285e42e1ed4c8477bfcb28e7e37
SHA512 73fa6d84e316f013309a01faf0502b958fecf1012c019489f106e8537b2e05b27f794cfde93634550760eac3df7f15fc908802c6c5c37e8e79385da5d8a90382
SSDEEP 192:+uyHZqHs2twUjktuGVPLwgzCKy7j96cXgQtoDKV4do:+FyqgIuMPUZf96ggY
TLSH
T14E42BF7AEC5D2E20F28EF3BC1F6AAC4BA336805C7A6588C516589D35343461574C0EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1724-45-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1724-47-0x0000000001F60000-0x0000000001F67000-memory.dmp

Download

memory/1724-46-0x00000000004A0000-0x00000000004A7000-memory.dmp

Download

memory/3296-9-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4168-28-0x0000000002090000-0x0000000002097000-memory.dmp

Download

memory/4168-27-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/4168-25-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads