ff123df0f42af235a0099c116ff32e7e41cfc12ed0a28c091f97ef48e583c8c1

Analysis

max time kernel
150s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Inject.vmad.exe
Size 372KB
Sample261018-vsd2easvat
SHA256 ff123df0f42af235a0099c116ff32e7e41cfc12ed0a28c091f97ef48e583c8c1
MD5 11d2b9544ad2e384f104982bd9321272
SHA1 e40d91f00d87cb0d9e953820135a4df374d71bb1
SHA512 070e7d2722edd7180aaed0d2cb369caad775bf7285fb47ba10e6d1f309abe45ca89428a58a79b8fd6260a19f82b477d2a8911ac81e8529d9afd1e4e4d42042b3
SSDEEP 6144:DDLdVHoX6HsWS20TfLG3Q7gtJiba5q+U/Ce6P7Vv9EjEOz:Ds0sWuj70Jiba5qH/y2
TLSH
T11484ADED59831733DB79DA308A7F14B8B6A0255FAC91495FBCD257F60A4AB43A6CC00C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3892	SwitchConvertToagent.exe
1884	SwitchConvertToagent.exe
1212	SwitchConvertToagent.exe
3620	SwitchConvertToagent.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{97F92E12-55CA-3EE8-794D-3AAB553736A7} = "C:\\Users\\Admin\\AppData\\Roaming\\SwitchConvertTo\\SwitchConvertToagent.exe"	SwitchConvertToagent.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3128 set thread context of 4828	3128	jaffacakes118_Trojan.Win32.Inject.vmad.exe	92
PID 3892 set thread context of 1884	3892	SwitchConvertToagent.exe	94
PID 1212 set thread context of 3620	1212	SwitchConvertToagent.exe	101
PID 1212 set thread context of 3620	1212	SwitchConvertToagent.exe	101

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
752	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SwitchConvertToagent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SwitchConvertToagent.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Inject.vmad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Inject.vmad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SwitchConvertToagent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SwitchConvertToagent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SwitchConvertToagent.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1884	SwitchConvertToagent.exe
1884	SwitchConvertToagent.exe
1884	SwitchConvertToagent.exe
1884	SwitchConvertToagent.exe
1884	SwitchConvertToagent.exe
1884	SwitchConvertToagent.exe
1884	SwitchConvertToagent.exe
1884	SwitchConvertToagent.exe
1884	SwitchConvertToagent.exe
1884	SwitchConvertToagent.exe
1884	SwitchConvertToagent.exe
1884	SwitchConvertToagent.exe

Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
1884	SwitchConvertToagent.exe
1884	SwitchConvertToagent.exe
1212	SwitchConvertToagent.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3892	SwitchConvertToagent.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1884	SwitchConvertToagent.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3128	jaffacakes118_Trojan.Win32.Inject.vmad.exe
3892	SwitchConvertToagent.exe
1212	SwitchConvertToagent.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 4828	3128	jaffacakes118_Trojan.Win32.Inject.vmad.exe	92
PID 3128 wrote to memory of 4828	3128	jaffacakes118_Trojan.Win32.Inject.vmad.exe	92
PID 3128 wrote to memory of 4828	3128	jaffacakes118_Trojan.Win32.Inject.vmad.exe	92
PID 3128 wrote to memory of 4828	3128	jaffacakes118_Trojan.Win32.Inject.vmad.exe	92
PID 3128 wrote to memory of 4828	3128	jaffacakes118_Trojan.Win32.Inject.vmad.exe	92
PID 4828 wrote to memory of 3892	4828	jaffacakes118_Trojan.Win32.Inject.vmad.exe	93
PID 3892 wrote to memory of 1884	3892	SwitchConvertToagent.exe	94
PID 3892 wrote to memory of 1884	3892	SwitchConvertToagent.exe	94
PID 3892 wrote to memory of 1884	3892	SwitchConvertToagent.exe	94
PID 3892 wrote to memory of 1884	3892	SwitchConvertToagent.exe	94
PID 3892 wrote to memory of 1884	3892	SwitchConvertToagent.exe	94
PID 4828 wrote to memory of 752	4828	jaffacakes118_Trojan.Win32.Inject.vmad.exe	95
PID 1212 wrote to memory of 3620	1212	SwitchConvertToagent.exe	101
PID 1212 wrote to memory of 3620	1212	SwitchConvertToagent.exe	101
PID 1212 wrote to memory of 3620	1212	SwitchConvertToagent.exe	101
PID 1212 wrote to memory of 3620	1212	SwitchConvertToagent.exe	101
PID 1212 wrote to memory of 3620	1212	SwitchConvertToagent.exe	101

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.vmad.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.vmad.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.vmad.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.vmad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Users\Admin\AppData\Roaming\SwitchConvertTo\SwitchConvertToagent.exe
    "C:\Users\Admin\AppData\Roaming\SwitchConvertTo\SwitchConvertToagent.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Users\Admin\AppData\Roaming\SwitchConvertTo\SwitchConvertToagent.exe
      "C:\Users\Admin\AppData\Roaming\SwitchConvertTo\SwitchConvertToagent.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of FindShellTrayWindow
      PID:1884
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp3d32ae34.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:752

C:\Users\Admin\AppData\Roaming\SwitchConvertTo\SwitchConvertToagent.exe
C:\Users\Admin\AppData\Roaming\SwitchConvertTo\SwitchConvertToagent.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Users\Admin\AppData\Roaming\SwitchConvertTo\SwitchConvertToagent.exe
  C:\Users\Admin\AppData\Roaming\SwitchConvertTo\SwitchConvertToagent.exe
  2⤵
  - Executes dropped EXE
  PID:3620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Process Injection

T1055

Defense Evasion

Modify Registry

T1112

Process Injection

T1055

Credential Access

Unsecured Credentials

T1552

Credentials in Registry

T1552.002

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ctrlSun

Path C:\Users\Admin\AppData\LocalLow\Sun\ctrlSun
Size 437B
SHA256 d03620ab2f01b2685686be66314adb89d06de01aa25ce86d8df591951bd6fe4d
MD5 2ad0384fb1038085bc3e3941c5282b52
SHA1 fb6ea3d010df4cc5b9bf91019705b053855cceb1
SHA512 74a70037c486ce8e1c417812855fd015ea4fe72f6f26a0435788ef8784dd0744918636d186a329d4404ff01c250c8fabc31bf3e251f4156f287e6617e6240486
TLSH
T159E023F7F70B2447B4D62135C835D987B80C3F306D0B59AAE1404B454DDEA1980E3F91
MD5 SHA1 SHA512 TLSH

Submit Download

tmp3d32ae34.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp3d32ae34.bat
Size 255B
SHA256 1dd0462225cb8ea77720b3592616063c232a500e605eab58c6457d2369e6f252
MD5 9444c8f2883ee7fbd346dd924e155e06
SHA1 1ec9e3180ab9a01a62027fadbd1f0081e79b94a3
SHA512 dc708c6659ab2b26a37dc30cd0845ff0f07d851ae93b22e805dd4c2cefb6c0832635c9f75f3e2302e7d043196016f8e702f7e3d02464fb93168104b9c1648fb1
TLSH
T108D02B4141C1C50C4C84E53B82F4668CF4180A0C2A893F245B22C089617141BB683355
MD5 SHA1 SHA512 TLSH

Submit Download

SwitchConvertToagent.exe

Path C:\Users\Admin\AppData\Roaming\SwitchConvertTo\SwitchConvertToagent.exe
Size 372KB
SHA256 6fd181af2ec5ff3b89df214660bd7289d7345f7196eb7d44928b46c75a30ee0c
MD5 6fb4f1c869558f9273ddcca2ffed36b6
SHA1 2b43d5b52755f8188cb19a9a458d8c2227a3b8a3
SHA512 b0e15f883a4d7c86864fbf1bc0e89b23fbb4b52914ee10593e3b0b16e199fc6e304e2547ea81d4e372b799f3696d2be1c06453eacf6e56c16dc8b763f440d4e3
SSDEEP 6144:DDLdVHoX6HsWS20TfLG3Q7gtJiba5q+U/Ce6PTVv9EjEOz:Ds0sWuj70Jiba5qH/O2
TLSH
T162849CED59831733DB79DA308A7F14B8B6A0155FAC914A5FBCD257F60A4AB43A6CC00C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1212-149-0x0000000002900000-0x0000000002941000-memory.dmp

Download

memory/1212-51-0x0000000002900000-0x0000000002941000-memory.dmp

Download

memory/1212-48-0x0000000002900000-0x0000000002941000-memory.dmp

Download

memory/1212-47-0x0000000002900000-0x0000000002941000-memory.dmp

Download

memory/1212-44-0x0000000002900000-0x0000000002941000-memory.dmp

Download

memory/1884-30-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1884-53-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1884-28-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1884-29-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1884-35-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1884-33-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1884-32-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1884-31-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1884-34-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/1884-27-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3620-61-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3620-54-0x00000000001A0000-0x00000000001E1000-memory.dmp

Download

memory/3620-146-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3620-68-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3620-66-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3620-65-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3892-50-0x0000000002040000-0x0000000002081000-memory.dmp

Download

memory/3892-45-0x0000000002040000-0x0000000002081000-memory.dmp

Download

memory/3892-46-0x0000000002040000-0x0000000002081000-memory.dmp

Download

memory/3892-43-0x0000000002040000-0x0000000002081000-memory.dmp

Download

memory/4828-8-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4828-10-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4828-38-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4828-2-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4828-11-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4828-19-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4828-9-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4828-7-0x0000000000400000-0x0000000000441000-memory.dmp

Download