7cc564f0d8c07af4e063195c31a6cdeb8d017e78a2edc112ac068e2ad93d07b7

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Delf.bj.exe
Size 54KB
Sample261009-wprnrssz8p
SHA256 7cc564f0d8c07af4e063195c31a6cdeb8d017e78a2edc112ac068e2ad93d07b7
MD5 e50375df00002c95a2cbf609ec2b7973
SHA1 6250e4b15854ef850a7825059d5adfa8d5dd2ec1
SHA512 255e5a8759a46849f5a3175f487b4beec66ad8e481ee3889471c7161122ca4e5a990e419f5a5af1157e5f6774fd0a104393bdf99039ab69d915f9990d873a988
SSDEEP 1536:1TpqUKDVmjZlft8ejZfnTjjp741hlyG9RI6op:R75jZttfjZfnTjjp7413yGzXop
TLSH
T113437D23E6E2CCB8E0E2DD7C2D2AE5115737BC331E3715A82995CDCD782A69148E5323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4260	jseeacrix.exe
5976	jseeacrixa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jseeacrix.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jseeacrix.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Delf.bj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jseeacrix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jseeacrixa.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 4260	3892	jaffacakes118_Trojan-Dropper.Win32.Delf.bj.exe	88
PID 3892 wrote to memory of 5976	3892	jaffacakes118_Trojan-Dropper.Win32.Delf.bj.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Delf.bj.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Delf.bj.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\temp\jseeacrix.exe
  "C:\Windows\temp\jseeacrix.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4260
- C:\Windows\temp\jseeacrixa.exe
  "C:\Windows\temp\jseeacrixa.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

id15[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MJOBZ9FO\id15[1].htm
Size 114B
SHA256 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
MD5 e89f75f918dbdcee28604d4e09dd71d7
SHA1 f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA512 8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0
TLSH
T1EEB092DDBC61E48018E535511EA3B60D146A22EBB9018B4018C00836A96035F8D0AAC5
MD5 SHA1 SHA512 TLSH

Submit Download

jseeacrix.exe

Path C:\Windows\Temp\jseeacrix.exe
Size 10KB
SHA256 d9896a117a8ab5128fad343c99cb7d34c33228935612682de7bc9f80a25d3cbf
MD5 f2535105c55118a93c2053eea3156a00
SHA1 02a5dc5e55823b45a731bb2040e497e01f55da8d
SHA512 dacfc44790903d801ca1d9844c9b0854e2d1fc9694e1663bba1f2ed36e0b451f8f0ffc46315ad4f844baf0e319788b5339debf2028b385ae4df883385d7202ff
SSDEEP 192:nmSU9F4IOskOvNywEMQqnYbfOMrwQDQ0ElQfyq3OQwu6fUQ4Jd:8fLk/5YYbfOMrVMQf17UfUVr
TLSH
T17922AF87F3E927A5E78392B9865C0A2E1C7C83F477AD54D86D9AFB3B8B430E00511719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jseeacrixa.exe

Path C:\Windows\Temp\jseeacrixa.exe
Size 5KB
SHA256 39360ee710b9c41d4571c91153167b9687ab90f23aa4c6f052f270754f38e5b3
MD5 a7e5bf121b58cd65af8113e296e61578
SHA1 8c551a96ca871e9bfe2302446f48c0e68a4046dc
SHA512 56cbd4043e0a5033807f8c32fe41594a72f4e1d60729034c87791db30d916d126c05d1115e54fd4e0d6aa1a6f3762be3751f47fe0f113a7f088bafc9641d9054
SSDEEP 96:5zD7o5xFgrxtpz9X+kND8aGgVgsmQSemy:hE5Lqkkt8GgsbS
TLSH
T1B3B1CE0365508831C4DDC5B806DB8B6397A2CE916BB29BB3C79032BA3D761A12C3D5CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3892-19-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4260-9-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4260-33-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/5976-20-0x0000000000400000-0x0000000000405000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads