ce5884307de41e2e30e58fcca079a6ccf11fd205c532e5c913be714776e197d1

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 19:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Scrop.olt.exe
Size 95KB
Sample261009-yen61at19j
SHA256 ce5884307de41e2e30e58fcca079a6ccf11fd205c532e5c913be714776e197d1
MD5 55d84f93a0a3e0f016c20abc6a94fd0e
SHA1 a9a26a3e48799b7c833673df626724510d82a6bb
SHA512 dea56098409d919c7ab005c0072beba2a1eb83cfd79f6e5a6530d673ad11b4c71b3310496bee60d2463c5653c7c3d970133eb35fd4c42f0c45c9308f31c4e873
SSDEEP 1536:rj7ftfkS5g9YOms+gZcQipICdXkNDqLLZX9lItVGL++eIOlnToIf/w+dOZ:r/FfHgTWmCRkGbKGLeNTBf/tQ
TLSH
T177A37C45F2E242F7E6F2053200A6716FD735A2389B24D8DBC74C2D529943AD1A73D3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4312	powershell.exe
3664	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4016	cmd.exe
5328	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Scrop.olt.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4312	powershell.exe
3664	powershell.exe
3664	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	3664	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 4016	2252	jaffacakes118_Trojan-Dropper.Win32.Scrop.olt.exe	91
PID 4016 wrote to memory of 5328	4016	cmd.exe	92
PID 5328 wrote to memory of 4312	5328	cmd.exe	93
PID 4016 wrote to memory of 3664	4016	cmd.exe	94
PID 3664 wrote to memory of 5416	3664	powershell.exe	95
PID 5416 wrote to memory of 244	5416	csc.exe	96

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Scrop.olt.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Scrop.olt.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\AA11.tmp\AA12.tmp\AA13.bat C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Scrop.olt.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\" "C:\Users\Admin\AppData\Local\Temp\" "C:\Users\Admin\AppData\Local\Temp\11224169144112991.ps1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\" "C:\Users\Admin\AppData\Local\Temp\" "C:\Users\Admin\AppData\Local\Temp\11224169144112991.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\11224169144112991.ps1" Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jopqmj21\jopqmj21.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5416
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB1E1.tmp" "c:\Users\Admin\AppData\Local\Temp\jopqmj21\CSC65E73CD4C774F0EB6C9993DB3668D3.TMP"
        5⤵
        
        PID:244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

11224169144112991.ps1

Path C:\Users\Admin\AppData\Local\Temp\11224169144112991.ps1
Size 2KB
SHA256 e45a569e195952175a1859b9d6d0b0ba363e0f1ed21c8fdfc863a5143ed4aae8
MD5 2bf5bc4aa00a8f6b91e11a9f7651fddb
SHA1 65e5af1a2a1c391795f217ab59f514765626efcc
SHA512 c37e43a1198263d783f3e5681d569cdeccafa7575f2bb589879028f3a3b7da0499b64abf6b1920aad393ff3268ad03c792a6d10942459d684b58925852b0cc26
TLSH
T16541CAB47F846CD0A7DDF747EC438E46E36B64726383908D71643EA52D178674E2C409
MD5 SHA1 SHA512 TLSH

Submit Download

AA13.bat

Path C:\Users\Admin\AppData\Local\Temp\AA11.tmp\AA12.tmp\AA13.bat
Size 7KB
SHA256 a298cf262f5fbb108b74d79be7b4e56b11281ff0a0ec6c307e2059a6e3611c21
MD5 def86ab8d27dc5f32e23d6f9ca69bac6
SHA1 9f25d6cd94d575e8d1629ca532bf9c629b9cc689
SHA512 77cbcceed6ce8d5c4435e7ae8914ed7209fe7b2fa062e00321d85caf476511688004327056387391b5b358d4aefefe7e48327721232bf9353e4b4216a979d205
SSDEEP 192:86h23j3wU4MyazCnM+Lz20z2i3z2Zz2lz2jz2fz2fz2nz2Sz2yz2Gz2Gz2sz2Wz4:86g3wU4MyazCnM+Lq0qi3qZqlqjqfqfF
TLSH
T175E130ECE8F5ECECADBA2F4188BF525199AC5DCB4A115F6AD35322D406076B27C240F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESB1E1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB1E1.tmp
Size 1KB
SHA256 9bd033be8f278c6d95a1c626c0cff014fcb3d920f3c93e27619f3069545821c3
MD5 76e52c822871d433cb5bb01392e086db
SHA1 7269b7354bb3b4ea11f72a9d33305aff41acbe51
SHA512 0b559170990feee64169dfc09500bcbef56c442800d308b94d6b4b039832486f973e8b6cf91dba6358b8edb0cc40ae47e2b04a8c01994049661fa8a57ca806dc
TLSH
T150218C0963EC4B0FF0735731A9F6571F9274FD64DFA2975A9550422C2C51504EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_e4bfkwfj.tkz.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e4bfkwfj.tkz.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

jopqmj21.dll

Path C:\Users\Admin\AppData\Local\Temp\jopqmj21\jopqmj21.dll
Size 3KB
SHA256 76a104eccbd952d13fed00c2cd5191a952e4c5318e382f073c392fed8be403b0
MD5 1e8237ca04f82ecdfa451cb0dac035a1
SHA1 51c599a0fed6a1657314bf19f013158db7db623e
SHA512 ad71210a657530c8d19741950fa0b3139f8ab482946771a3f449f65dabdbfe89d841833d604e04eb936162df77ba68e9d283fead3832aba3d70702ca959d52e8
TLSH
T19571DA1AA7E84127E8B70734AEF3831327B4F8608F72976E19410259BC542284E30FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC65E73CD4C774F0EB6C9993DB3668D3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\jopqmj21\CSC65E73CD4C774F0EB6C9993DB3668D3.TMP
Size 652B
SHA256 3e1578646fe9f710ca06919df2e0f0b6aa8133ed94f49735ffd263dee21baa15
MD5 73131c9f12dec986e1e6e0262f0e1873
SHA1 faa8a9cd6414ba486ef813729d2f47e041fc05c5
SHA512 34163dc3b179e0ff3cc8a2884d7110fe1c2d5ce01d82c8faf81da3ef22581411e9c3ce3f1a84974a9726376484c9df6edf5e00463e0f1c949ce0e0cedd06e5db
TLSH
T1DEF03A0973FC420AF0F38B31BAF6436795A8BC74DE3293ED2490031D28645209A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

jopqmj21.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\jopqmj21\jopqmj21.0.cs
Size 302B
SHA256 203564835bc9c9b82777d998dce08841db9dc2129af1c8b8fe2b6138ee1feb8f
MD5 123aeedcf8d35053ac39c37b572c2f4d
SHA1 046da2e8d2385a46a0b7eb1c9d6de4b7f2bf1d92
SHA512 706776ebf6e12f77f98f49099e3cf46e8da019a9799fe1c851be87132d9c448c7a58f38a96002f2e53b141fe8bdda092c3df68daab7c810566035c3e1e6e5d05
TLSH
T1D7E0CD74A757D67884A35B095C048655672AE264B3D9750367D506714F0303D013C72B
MD5 SHA1 SHA512 TLSH

Submit Download

jopqmj21.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\jopqmj21\jopqmj21.cmdline
Size 369B
SHA256 09dbfd90399f458f95f5c9f8c342b15d2290c5be252fea9c299a37cb3dec47bc
MD5 e3e5991569625fc7bbdd705ca9e9f7a8
SHA1 48dbd7bf733dbf42d31e7042a540710ff5c524d8
SHA512 cfc64b72df6674fb45f9259c0444d563cdc24afe32ddc8453b3e6d51e9cf7f7610e23df977ffe3fc97a67933f44d390703c1d8eead5253c96aded0da6c430858
TLSH
T19CE0C02E52E6CA7E41ED100762E9CDADC2B327C329403F8CD06144CDD0170042FD1F41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2252-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download

memory/3664-96-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/3664-102-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/3664-81-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/3664-82-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/3664-83-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/3664-84-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/3664-77-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/3664-76-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/3664-94-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/3664-80-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/3664-100-0x000001A50C510000-0x000001A50C518000-memory.dmp

Download

memory/3664-103-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/4312-75-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/4312-69-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download

memory/4312-68-0x00007FFED5E0F000-0x00007FFED5E10000-memory.dmp

Download

memory/4312-72-0x0000023C5D890000-0x0000023C5D8B2000-memory.dmp

Download

memory/4312-74-0x00007FFED5C80000-0x00007FFED6624000-memory.dmp

Download