7f1f6e65a76b466f7096d984337cb0d705027abb2d8ef53f0b7f2baf5a3506a0

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Flystud.adt.exe
Size 1.1MB
Sample261009-xcbbpadf72
SHA256 7f1f6e65a76b466f7096d984337cb0d705027abb2d8ef53f0b7f2baf5a3506a0
MD5 9e339c1a15d6ffe4519cb92acfffae74
SHA1 e4fc96d7099b904cf4d2ed20f081870294164d91
SHA512 9743fa15b48332f51be44399538747329f8e1d18506bd181da0501e7023d40559332ca968d4d0212035f044797535979e2dea965c5d0805fb21cdc6eda8db866
SSDEEP 24576:3gkARYvw/d4pka37Boy9jAuhzBjjgjWK2sYMnZ3aT9YU:vpZrBbAuxBjck7
TLSH
T1783533E6BF4F2D8AD1B23A32B04A92B7D7BBB9743DB1D28259C89C571C42F501864713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
608	irsetup.exe
4052	ko22.exe

Loads dropped DLL 5 IoCs

pid	Process
4052	ko22.exe
4052	ko22.exe
4052	ko22.exe
4052	ko22.exe
4052	ko22.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\1\EThread.fne	irsetup.exe
File created	C:\Program Files (x86)\1\EThread.fne	irsetup.exe
File opened for modification	C:\Program Files (x86)\1\internet.fne	irsetup.exe
File created	C:\Program Files (x86)\1\internet.fne	irsetup.exe
File opened for modification	C:\Program Files (x86)\1\ko22.exe	irsetup.exe
File created	C:\Program Files (x86)\1\ko22.exe	irsetup.exe
File opened for modification	C:\Program Files (x86)\1\krnln.fnr	irsetup.exe
File created	C:\Program Files\NetMeeting\win.vbs	ko22.exe
File created	C:\Program Files (x86)\1\krnln.fnr	irsetup.exe
File opened for modification	C:\Program Files\NetMeeting\win.vbs	ko22.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	irsetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ko22.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ko22.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	irsetup.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Flystud.adt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ko22.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2900	regedit.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
608	irsetup.exe
608	irsetup.exe
4052	ko22.exe
4052	ko22.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 608	4856	jaffacakes118_Trojan-Dropper.Win32.Flystud.adt.exe	90
PID 608 wrote to memory of 4052	608	irsetup.exe	91
PID 4052 wrote to memory of 2900	4052	ko22.exe	92
PID 4052 wrote to memory of 3128	4052	ko22.exe	103

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Flystud.adt.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Flystud.adt.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Temp\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\irsetup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:608
- - C:\Program Files (x86)\1\ko22.exe
    "C:\Program Files (x86)\1\ko22.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\Windows\SysWOW64\regedit.exe
      regedit /s C:\WINDOWS\temp\tmp.reg
      4⤵
      System Location Discovery: System Language Discovery
      Runs .reg file with regedit
      PID:2900
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c del ko22.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EThread.fne

Path C:\Program Files (x86)\1\EThread.fne
Size 60KB
SHA256 64eef86745d7ae0168fec357099e2e952ce74ee19576d06cc8c8c65f210cc22c
MD5 206396257b97bd275a90ce6c2c0c37fd
SHA1 3cae4506a033cf7e97156d5261f2a247c6270f42
SHA512 4c23e52b5b23b305c3172e01dd205e15fda8f20f8b60776ba59d080bf05bbbca456a0ed232f2e2a2bf01d32efb913063f89fb4928bc4d5d1c1eb4c4979803455
SSDEEP 768:r3gWNW3gyVNWTmOPMJcyS6K7viaViB9V5yHQ6Fq4oCaJa2OJK:TXkSTmOP0Cbu2BboCaKJK
TLSH
T1D45359192C5304B3F0594830D7D506F69FFE6D033BC3646FDFA0D5482EA19A991AA9B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

internet.fne

Path C:\Program Files (x86)\1\internet.fne
Size 188KB
SHA256 adc45970f4a0eafd2f372302f64836802380c253096a99ca964677a70a7128f8
MD5 7b129c5916896c845752f93b9635fc4c
SHA1 e3fc632af5e1f36e8022e651f64eb8f8381c73c3
SHA512 c72dd4043e7cdc0ccefe26ce8a6d05701b4c610f88ab827e6731296da76b8cbe5b63c0970954ec7616369172b8b8f9cb546545271be3e86c18c54d0b9cad8f95
SSDEEP 3072:mpTEys+TR7yRoHzXjlhvtcxVIThpEbbAKNXoqlSY9M02MF8:mpTEt+ycLHlCIThpEX9+XM
TLSH
T13114AF0239D2C4B9D29F123C09526B7AD7BFE912CFB2DB839750CE4C6E716419D36226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ko22.exe

Path C:\Program Files (x86)\1\ko22.exe
Size 64KB
SHA256 5cf21a67393d834a1c6d19a75f570c0ea5e9d723ac6a24996f85093d59d340e0
MD5 368c2b32d4554f4f6aec6be3d0022133
SHA1 abcf3faa36093d175778dca89c7d8a55429ae23d
SHA512 b6f3c8bb4f0d16d9568d6bc52e4ef2632f68e9d1ee4db7e3228606d99723b0595ae5f85d2198cdb0d090a302593babd69c9fe4f6b4f88da7036aa4fb9ccd4b78
SSDEEP 768:YadRUkG6sTuQkjXUx8YpWbuXvRjI8mD6TKjDVXD2UwLl7hotwwffEyHw3BYakwjn:bRUk6CZXF8h
TLSH
T1A953A663F3188991E1B409B202F6472499B8FE62A8725957E7D0BF72EC32731BE4553C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

krnln.fnr

Path C:\Program Files (x86)\1\krnln.fnr
Size 1.0MB
SHA256 6ced19283dbbb95f264448f380592f4e98ba8228efca2f68821ab3ae61029d93
MD5 44e2ca67c060fbe3dc0d030149f5a478
SHA1 5df61eb626bc3849893701942114609c1086d496
SHA512 1a348c7585d78dd68c1d0e059ea1d7cea57c1aeff734f834f75025719b9fdd0e9bb16aebe75e15502a1b83106387eaa9493b8990999e0a68b62c1afdbc8cf45e
SSDEEP 12288:rb0+sqCE6yy4bmhSd+1YCHYFZzktq0TNSARuOrRUVbNGvNXXYA/2b:AjE6+bhiHYF5kZI6uOrRUjYNXXYA/
TLSH
T140358D01BA9A40B1C70D1A70187E7736AB7D8A470B108BE76F64ED6C7972181EF3356E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG1.BMP

Path C:\Users\Admin\AppData\Local\Temp\IRIMG1.BMP
Size 7KB
SHA256 0542cb1d3e6b50f78dc63ea1abec6c518cfd4ea203649df3ef3834309ea66cad
MD5 95145f4cead2c4bd2ec219bc87d83f1d
SHA1 5eec034dfc7d9a6d93c21f38dfe2405c8968f6ed
SHA512 081d9cfa0bc46a54fcf03a62e5663282d27f56e20fbeafba2833d6267de285a354915c661dd67a3217f4dc2330c7f49babf8b24a5a68ba5a014f5e1e297cc5df
SSDEEP 192:QHwjo8GQNtsYP8uiJeiNN8FKdC2b/5qr25VPDtLwk:CXXq3Pj4NNYOBjAkdJ
TLSH
T1A1F16C69E1204553CA26057EC51D3E30BC5A18F9D0A3E3D8DD822B72FBC789976D528F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irsetup.dat

Path C:\Users\Admin\AppData\Local\Temp\irsetup.dat
Size 1KB
SHA256 7e2ed42d04e2c08dd9079be217ce884d673fe7fac34f64e61ba96800c61d4747
MD5 e2e7cd72e8312b77110491a8830e3a5e
SHA1 8e706d8a8f06fd244d2662b0921509cc338209a8
SHA512 53e7c1e33862b146dc9e28ed28a86b631f87972724e257332c1f7080d7976048dc20779d0a9ffad30af85c5e4f2964eeafc8c033e14c7a809b3b9dc95392832a
TLSH
T133418DC1FF47FF7CC040B4B15021076A6BB3E540B835AB5FA269C7549E41B954FB4292
MD5 SHA1 SHA512 TLSH

Submit Download

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\irsetup.exe
Size 708KB
SHA256 3687a458ea72df00e771a62c3eff33849631c662f62c9bb4fa3c735cc2b51b39
MD5 9433d5ac20edcf7d39c454fe2f67b43d
SHA1 b46be8abecd975d942bf28987bbda8686f079838
SHA512 50fdfb6d8a5305970b65c772de6b1fe1f4791ea379821853579c99e72dc9c3e36d6e9129451ade3084616996abac84137a4446f9747c195695c5d49fd5073ffe
SSDEEP 12288:HQdzkzzNjhuD4m/xVEL11S0eCqIpqGWwv5gHSbAV9P/Mjw3o/FcBu47W9b:HCdILS0eCqI0Hw4BVdLJR7W9
TLSH
T1DDF47B2A79B1803AC1B20671DBB857B2F1B3B9360D771E0773C25B7C1A39D41A816B79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irsetup.ini

Path C:\Users\Admin\AppData\Local\Temp\irsetup.ini
Size 119B
SHA256 6b6f0dea6727045e356e2e9232205e83f05f2d38fa9cd062259b233b434719ac
MD5 72fabf7a127b3fa5d7bb5283ce9aca04
SHA1 a8efed9a12b171ba245a4345cdb585db782cc64d
SHA512 3cf601f3760f13ae9e3b1ca0cf6bc932fec32d4c641d2aea9e31b8caf56e2261fa20c24927fe89f5b8f7c776a96b92d2919c73810969a0abaa797ac7bb61f3ee
TLSH
T128B0922C99C289954906C9770AB5565FB4260A482695BB24137AE48C2A6144A638231C
MD5 SHA1 SHA512 TLSH

Submit Download

suf6lng.4

Path C:\Users\Admin\AppData\Local\Temp\suf6lng.4
Size 12KB
SHA256 244f0d831a3ae9b8e3d6781846fb5be32ec5a8962de5e2fd713a1638da7af259
MD5 e8b3f91ea0e4882f83a6614cca5cda73
SHA1 4baa82004cf14ce741d2426009959d9c2ff85738
SHA512 4cb119f3f92ff467cabe833b4eb0040886ff4dc6779dab5df2a74d45be2f03ea28764688c2fe1721d9e2de8c1ea3e69ab7e0a04559d4bff323ee915dde6f026b
SSDEEP 192:8DwOJh3O8xkJqH5GpMxl4kOqT2ZF7Ro5ZnYUPCwaWI3pIXblieWgUIGvExP:DOLhxkJ5pMxl4kO82ZF2hy0bAlbe
TLSH
T19742B42FA50BC1526FF37764507820BB75BC81962E6C5B63D48D34D300BA2BA7B647C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.reg

Path C:\Windows\Temp\tmp.reg
Size 1KB
SHA256 77730b194cf461a72285734ae3aafa83b435bb6b5587f31779f2ef5e43666906
MD5 a95044fc8bd71a6ecdd487f2a30f1d4e
SHA1 0e1ba880fdc2ac01b84febdbb4b5325a5ecfc706
SHA512 ee8d894e25716c5b54809855ca73ae680dee9b01478cbd8b9417d3d388448df496b27c1f7ab75a9757dc76d8e41ad1a64a5a720e249fcd9a25707ccda5f6692d
TLSH
T15C21D7600E76C221D0A0A841CB5BF54D27BEE55A31C3CA2E40F5F652A617DDB987C78E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4052-24-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4052-30-0x0000000002150000-0x000000000216C000-memory.dmp

Download

memory/4052-33-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4052-37-0x0000000002320000-0x000000000235E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads