Analysis
- max time kernel
119s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
18/10/2026, 17:50
General
- Target jaffacakes118_Trojan.Win32.Hesv.ceql.exe
- Size 6.9MB
- Sample261018-we22rafv7m
- SHA256 861d3d35beab6770af9543243abe7ec66190dd1d551afbcc6bf0e7c6c5eb3830
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 14 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 3 IoCs
- Drops file in Program Files directory 16 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Modifies registry class 64 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 30 IoCs
- Suspicious use of SendNotifyMessage 28 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Hesv.ceql.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Hesv.ceql.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-P25Q0.tmp\jaffacakes118_Trojan.Win32.Hesv.ceql.tmp"C:\Users\Admin\AppData\Local\Temp\is-P25Q0.tmp\jaffacakes118_Trojan.Win32.Hesv.ceql.tmp" /SL5="$4011A,6954525,54272,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Hesv.ceql.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\ODP To PPT Converter Software\Comdlg32.ocx"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\ODP To PPT Converter Software\mscomctl.ocx"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\ODP To PPT Converter Software\x\sbls.ocx"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\ODP To PPT Converter Software\x\sblc.ocx"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\ODP To PPT Converter Software\tscc.exe"C:\Program Files (x86)\ODP To PPT Converter Software\tscc.exe" /s3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GLBDE02.tmpC:\Users\Admin\AppData\Local\Temp\GLBDE02.tmp /s4736 C:\PROGRA~2\ODPTOP~1\tscc.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Program Files (x86)\ODP To PPT Converter Software\ODP To PPT Converter Software.exe"C:\Program Files (x86)\ODP To PPT Converter Software\ODP To PPT Converter Software.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Comdlg32.ocx
HAND-M.CUR
ODP To PPT Converter Software.exe
How To Use ODP To PPT Converter Software - Reduced.avi
icon256.gif
mscomctl.ocx
tscc.exe
unins000.exe
o.cjs
sblc.ocx
sbls.ocx
CurrentDatabase_400.wmdb
CurrentDatabase_400.wmdb
LocalMLS_3.wmdb
WMSDKNS.XML.bak
GLBDE02.tmp
GLCDE41.tmp
GLFE085.tmp
jaffacakes118_Trojan.Win32.Hesv.ceql.tmp
wmsetup.log
temp.000
memory/1100-0-0x000000000040D000-0x000000000040E000-memory.dmp
memory/1100-1-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1100-16-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5028-113-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/5028-946-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/5028-8-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/5028-12-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/5028-21-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/5028-15-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/5028-19-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/6124-177-0x0000000076360000-0x0000000076411000-memory.dmp
memory/6124-168-0x0000000004D70000-0x0000000004DF9000-memory.dmp
memory/6124-191-0x0000000074DA0000-0x0000000074E21000-memory.dmp
memory/6124-190-0x0000000004D70000-0x0000000004DF9000-memory.dmp
memory/6124-187-0x0000000073020000-0x000000007303C000-memory.dmp
memory/6124-183-0x0000000010000000-0x00000000101B4000-memory.dmp
memory/6124-181-0x0000000076EC0000-0x0000000077015000-memory.dmp
memory/6124-180-0x0000000077390000-0x0000000077472000-memory.dmp
memory/6124-179-0x0000000073430000-0x000000007358D000-memory.dmp
memory/6124-203-0x0000000073040000-0x00000000730D1000-memory.dmp
memory/6124-175-0x0000000075B70000-0x000000007614C000-memory.dmp
memory/6124-172-0x00000000217A0000-0x00000000217C3000-memory.dmp
memory/6124-182-0x0000000074DA0000-0x0000000074E21000-memory.dmp
memory/6124-197-0x0000000076360000-0x0000000076411000-memory.dmp
memory/6124-176-0x0000000073040000-0x00000000730D1000-memory.dmp
memory/6124-174-0x0000000076EC0000-0x0000000077015000-memory.dmp
memory/6124-171-0x0000000027580000-0x0000000027686000-memory.dmp
memory/6124-170-0x00000000730E0000-0x000000007321C000-memory.dmp
memory/6124-169-0x0000000073430000-0x000000007358D000-memory.dmp
memory/6124-167-0x0000000027580000-0x0000000027686000-memory.dmp
memory/6124-162-0x0000000027580000-0x0000000027686000-memory.dmp
memory/6124-164-0x0000000073430000-0x000000007358D000-memory.dmp
memory/6124-161-0x0000000010000000-0x00000000101B4000-memory.dmp
memory/6124-160-0x0000000073430000-0x000000007358D000-memory.dmp
memory/6124-136-0x0000000010000000-0x00000000101B4000-memory.dmp
memory/6124-157-0x0000000027580000-0x0000000027686000-memory.dmp
memory/6124-154-0x0000000010000000-0x00000000101B4000-memory.dmp
memory/6124-198-0x0000000004D70000-0x0000000004DF9000-memory.dmp
memory/6124-151-0x0000000073430000-0x000000007358D000-memory.dmp
memory/6124-195-0x0000000073040000-0x00000000730D1000-memory.dmp
memory/6124-166-0x0000000073040000-0x00000000730D1000-memory.dmp
memory/6124-165-0x0000000076290000-0x00000000762B5000-memory.dmp
memory/6124-159-0x0000000004D70000-0x0000000004DF9000-memory.dmp
memory/6124-155-0x0000000073040000-0x00000000730D1000-memory.dmp
memory/6124-156-0x0000000073020000-0x000000007303C000-memory.dmp
memory/6124-199-0x0000000074DA0000-0x0000000074E21000-memory.dmp
memory/6124-152-0x00000000759C0000-0x0000000075A3E000-memory.dmp
memory/6124-153-0x0000000076290000-0x00000000762B5000-memory.dmp
memory/6124-150-0x0000000004D70000-0x0000000004DF9000-memory.dmp
memory/6124-149-0x0000000073020000-0x000000007303C000-memory.dmp
memory/6124-148-0x0000000073040000-0x00000000730D1000-memory.dmp
memory/6124-147-0x0000000076290000-0x00000000762B5000-memory.dmp
memory/6124-146-0x00000000759C0000-0x0000000075A3E000-memory.dmp
memory/6124-145-0x0000000004D70000-0x0000000004DF9000-memory.dmp
memory/6124-142-0x0000000004D70000-0x0000000004DF9000-memory.dmp
memory/6124-141-0x0000000073040000-0x00000000730D1000-memory.dmp
memory/6124-140-0x00000000759C0000-0x0000000075A3E000-memory.dmp
memory/6124-139-0x0000000004D70000-0x0000000004DF9000-memory.dmp
memory/6124-138-0x00000000217A0000-0x00000000217C3000-memory.dmp
memory/6124-137-0x0000000027580000-0x0000000027686000-memory.dmp
memory/6124-135-0x00000000759C0000-0x0000000075A3E000-memory.dmp
memory/6124-178-0x0000000004D70000-0x0000000004DF9000-memory.dmp
memory/6124-134-0x0000000073430000-0x000000007358D000-memory.dmp
memory/6124-163-0x0000000004D70000-0x0000000004DF9000-memory.dmp
memory/6124-158-0x00000000217A0000-0x00000000217C3000-memory.dmp
memory/6124-173-0x0000000004D70000-0x0000000004DF9000-memory.dmp
memory/6124-143-0x0000000073430000-0x000000007358D000-memory.dmp
memory/6124-144-0x00000000759C0000-0x0000000075A3E000-memory.dmp
memory/6124-129-0x0000000004D70000-0x0000000004DF9000-memory.dmp