7cbe6e0e27c43a46d705dd86d03c1eca5890ceebc9e2eb5dbda06615c2fd4ba4

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Delf.ab.exe
Size 92KB
Sample261009-wmax8sdc65
SHA256 7cbe6e0e27c43a46d705dd86d03c1eca5890ceebc9e2eb5dbda06615c2fd4ba4
MD5 9b1cac1372875adac79380652ed5af6b
SHA1 458564e161f784e167d7427225335176d50a4ec3
SHA512 de481c629f8846c16f833f67e3d72ad079f92ddef352b672b6c5be78ca64ea4a65310c0aff342c2ce9617c0061230e859625506a6da3a78f2f4140dcb53cf938
SSDEEP 1536:gZSqzS/1sYCDZeSoFr8pTTign/Hx8d22gX5ieNq5tQQW6zyXHzWisgjZWeT1GcjM:sS/1cDZ7Ar8pd1HGQQVuTJPFT1GcX
TLSH
T11493CF6E75799BB1C490D1BCCF6E91FCBEA394A7740A396564433BCA5CBE3400A068C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4820	~DP45.exe
4808	iexplore.exe

Loads dropped DLL 7 IoCs

pid	Process
4820	~DP45.exe
4820	~DP45.exe
4820	~DP45.exe
4808	iexplore.exe
4808	iexplore.exe
4808	iexplore.exe
4808	iexplore.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Iexplore Services = "iexplore.exe"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\Iexplore Services = "iexplore.exe"	iexplore.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\iexplore.exe	~DP45.exe
File opened for modification	C:\Windows\SysWOW64\v_ca32.dll	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\v_in32.dll	iexplore.exe
File created	C:\Windows\SysWOW64\iexplore.exe	iexplore.exe
File created	C:\Windows\SysWOW64\v_ca32.dll	~DP45.exe
File created	C:\Windows\SysWOW64\v_in32.dll	~DP45.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	iexplore.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Delf.ab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~DP45.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	~DP45.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	~DP45.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	iexplore.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings	jaffacakes118_Trojan-Dropper.Win32.Delf.ab.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3404	mspaint.exe
3404	mspaint.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4820	~DP45.exe
Token: SeShutdownPrivilege	4820	~DP45.exe
Token: SeSecurityPrivilege	4808	iexplore.exe
Token: SeShutdownPrivilege	4808	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3404	mspaint.exe
3404	mspaint.exe
3404	mspaint.exe
3404	mspaint.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 3404	3584	jaffacakes118_Trojan-Dropper.Win32.Delf.ab.exe	89
PID 3584 wrote to memory of 4820	3584	jaffacakes118_Trojan-Dropper.Win32.Delf.ab.exe	90
PID 4820 wrote to memory of 4808	4820	~DP45.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Delf.ab.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Delf.ab.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\SysWOW64\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\~DPFE8F.jpg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3404
- C:\Users\Admin\AppData\Local\Temp\~DP45.exe
  "C:\Users\Admin\AppData\Local\Temp\~DP45.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\SysWOW64\iexplore.exe
    "C:\Users\Admin\AppData\Local\Temp\~DP45.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:2552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~DP45.exe

Path C:\Users\Admin\AppData\Local\Temp\~DP45.exe
Size 57KB
SHA256 44535437e72cef56699e0936e1234f0f3cf0109a73148906ff3ced6fcb9dee57
MD5 326b867fb3f4c28f8566ebeb46086dab
SHA1 7be61565063e681a34df199c8bb0005a10521130
SHA512 1ca38048ed52157d24e6e90ccda7ba14520e745bf9145704b7234d4e163b0cb8bc20513f630256b5b4a3700757b6f8e90cf6718b97e029265d8afdffed9bcdc1
SSDEEP 1536:kgn/Hx8d22gX5ieNq5tQQW6zyXHzWisgjZWeT1GcjDo+:n1HGQQVuTJPFT1GcXz
TLSH
T165438BADA57E57B9C952E27CCFAD65EDBDA780D7B01A2C64604353E74C9F2804242CC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~DPFE8F.jpg

Path C:\Users\Admin\AppData\Local\Temp\~DPFE8F.jpg
Size 18KB
SHA256 b3f648d4df40aac05f1fe29b2b79428a0ee75a71562047e65fdedce701afdc3d
MD5 8effb580b8a0a86412684013fcf299d7
SHA1 0294e8911d424a6693ca56bdabade83585abc110
SHA512 f92ecd80de1c05880524489bed63a0d22581e398e442a743130e72cc0dc4765d6acf14c5d64185eb88c08b43b37ce4c211a28331dda2b1419a0a5173b1380493
SSDEEP 384:VzJYNg7/M9yu8eTyQncyHXa2rDwDLlOs4Yo7ImOxq8BNH:hJYyLMoZeT2oFr8pukmUnBx
TLSH
T1E682AF2B1B66EE76D9F1D2F86CE3CFC4E340AE0BA62376972514730D74F01D41806255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v_ca32.dll

Path C:\Windows\SysWOW64\v_ca32.dll
Size 15KB
SHA256 ea0caec63d1f385382aa4fed6ff61fbf729677abc4af9e6b68fea4e5f4cbd83f
MD5 05974d013ae060409aa2d89e7f00545d
SHA1 2d5ac6bb0af09cbf031dd9c482b90669b8826e3a
SHA512 b80d5345ba10779470d0f16bb7052a4e02fd8556b550791e542f9229ea8d23f6b5aaf3439b049efcaed179324f48e4d033cb12a342f42cab2c8afc4bfa77d236
SSDEEP 384:RkxP7dHESi9PkN3yzNda1IuMPUZf96ggY:R2+SykN3YNdaT2u6xY
TLSH
T17162C0FEAD9D3C34F1FAF7351AAD5818E626881E356B0094099ABC303568A9018C7E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v_in32.dll

Path C:\Windows\SysWOW64\v_in32.dll
Size 12KB
SHA256 37b5c455e1b17406077f2e896c900b29d4350f8288fe4a7fc345cc1cb9321a91
MD5 81d79ec94b92f5081a5c7c89ab9a880a
SHA1 add4f4bdc36e7285e42e1ed4c8477bfcb28e7e37
SHA512 73fa6d84e316f013309a01faf0502b958fecf1012c019489f106e8537b2e05b27f794cfde93634550760eac3df7f15fc908802c6c5c37e8e79385da5d8a90382
SSDEEP 192:+uyHZqHs2twUjktuGVPLwgzCKy7j96cXgQtoDKV4do:+FyqgIuMPUZf96ggY
TLSH
T14E42BF7AEC5D2E20F28EF3BC1F6AAC4BA336805C7A6588C516589D35343461574C0EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3584-13-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4808-48-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4808-50-0x0000000002120000-0x0000000002127000-memory.dmp

Download

memory/4808-49-0x00000000020F0000-0x00000000020F7000-memory.dmp

Download

memory/4820-30-0x0000000002220000-0x0000000002227000-memory.dmp

Download

memory/4820-29-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/4820-28-0x0000000000400000-0x000000000040F000-memory.dmp

Download