aa342f0e7ba9367b30f974387486817e1ed532d0bc9c64a86c3fd2763d67f80b

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_[DL] Top.Rated.Software.September.20.2008.Pack-DLFT .exe
Size 485KB
Sample260910-ct7e8stflg
SHA256 aa342f0e7ba9367b30f974387486817e1ed532d0bc9c64a86c3fd2763d67f80b
MD5 9fcea0bc6a2defb00a6b3e4144e18d1c
SHA1 3860b67c633c3205dc827a5ecd343582b3b3676a
SHA512 05e7a2fb1cea81e0695b4830378002699c82629b4e3adf38609f6472fd1259176938d530dff4de1513cc2599beedb50ace99d0d4a3ca23859af6b57b3c8e4159
SSDEEP 12288:1AHm8hzQOKdrCP75X6m0Xd/gC0r7aOoEU8emji:eQ9dGPtX6m0XdId7HN
TLSH
T11EB4CFE13CC0AABBDA5241F14D58CA509252FC7EDF0729C737BE3FC586392EA4521A52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Looks for VMWare drivers on disk 2 TTPs 1 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\SysWOW64\drivers\vmmouse.sys	jaffacakes118_[DL] Top.Rated.Software.September.20.2008.Pack-DLFT .exe

Executes dropped EXE 3 IoCs

pid	Process
5416	nzm.exe
4964	Keygen.exe
2792	nzm.exe

Loads dropped DLL 1 IoCs

pid	Process
4964	Keygen.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5416 set thread context of 2792	5416	nzm.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_[DL] Top.Rated.Software.September.20.2008.Pack-DLFT .exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nzm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Keygen.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2500	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2500	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5416	nzm.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5676 wrote to memory of 5416	5676	jaffacakes118_[DL] Top.Rated.Software.September.20.2008.Pack-DLFT .exe	89
PID 5676 wrote to memory of 4964	5676	jaffacakes118_[DL] Top.Rated.Software.September.20.2008.Pack-DLFT .exe	90
PID 5416 wrote to memory of 2792	5416	nzm.exe	92
PID 5416 wrote to memory of 2792	5416	nzm.exe	92
PID 5416 wrote to memory of 2792	5416	nzm.exe	92
PID 5416 wrote to memory of 2792	5416	nzm.exe	92
PID 5416 wrote to memory of 2792	5416	nzm.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_[DL] Top.Rated.Software.September.20.2008.Pack-DLFT .exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_[DL] Top.Rated.Software.September.20.2008.Pack-DLFT .exe"
1⤵
- Looks for VMWare drivers on disk
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5676
- C:\Users\Admin\AppData\Local\Temp\nzm.exe
  "C:\Users\Admin\AppData\Local\Temp\nzm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5416
- - C:\Users\Admin\AppData\Local\Temp\nzm.exe
    C:\Users\Admin\AppData\Local\Temp\nzm.exe
    3⤵
    - Executes dropped EXE
    PID:2792
- C:\Users\Admin\AppData\Local\Temp\Keygen.exe
  "C:\Users\Admin\AppData\Local\Temp\Keygen.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4964

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004C0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

File and Directory Discovery

T1083

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Keygen.exe

Path C:\Users\Admin\AppData\Local\Temp\Keygen.exe
Size 52KB
SHA256 7cae62ba19a7f198b5e9a7c59e31a0d5b75382baba416e3b18e20bc41a5a66e0
MD5 b1fc14eeb478a72a39abbe8c5385b2b8
SHA1 db45472bbfeeb2976ba1815aca861b96e9d2b5b6
SHA512 2b8ba6cd545032bb6cc2ead734372b2e3c238ca69ed6103267f257011097c03aa7a5b526bd35b4fd5ae9ef2454f57cee26dfa87d38a46c3c5812ef9d77ef952c
SSDEEP 1536:h9O+ysIXQZzLWTkz6e4y+p299EuIOsLmR:/uXQZ/WTkz6a+8DINs
TLSH
T17933E046E9DDD049E72181B30F63CB2CC68EAE0510489A27B79C76597FB3B8B47CA51C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bassmod.dll

Path C:\Users\Admin\AppData\Local\Temp\bassmod.dll
Size 9KB
SHA256 844eb66a10b848d3a71a8c63c35f0a01550a46d2ff8503e2ca8947978b03b4d2
MD5 780d14604d49e3c634200c523def8351
SHA1 e208ef6f421d2260070a9222f1f918f1de0a8eeb
SHA512 a49c030f11da8f0cdc4205c86bec00653ec2f8899983cad9d7195fd23255439291aaec5a7e128e1a103efd93b8566e86f15af89eba4efebf9debce14a7a5564b
SSDEEP 192:Yjtr1Et860Vu6tAo2j+feMnkqtDXuulsa7k0yRlm7/Pdl:AtU8Zu6K+feJCuwsL00la/Pd
TLSH
T19D127C8596D008B2C16E2070DAD579ADA77B75E00AC9EF436ED309A48CCEF63DC8C706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nzm.exe

Path C:\Users\Admin\AppData\Local\Temp\nzm.exe
Size 280KB
SHA256 1d22e37a8b0bc15b7b0873f8783846086b688853dc1935382ffbfa83e3e99ff0
MD5 630a85990935eb25ccb37f0649ec3dd6
SHA1 157ccac4c30add444168813964304f63963a5c2e
SHA512 b456a561ab94d265ca07a077d626fc529cdcfe99fba5325de136992cc38cbc9798e647a62d233030dbe5401606bc3748c161a032429f0b8aab81ce7eca5c1e97
SSDEEP 6144:Ppp8ArbPiWPThRjkO9Y5DakT3mPN1shm/h:PECbPiWPAOqlxmPZ5
TLSH
T1A754DFE122B30825E214E9B1D4916FE02742DE9D6AFEC722046B1E739470E91FD9DF27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2792-29-0x0000000000400000-0x000000000051B000-memory.dmp

Download

memory/4964-20-0x0000000000400000-0x000000000048B000-memory.dmp

Download

memory/4964-23-0x0000000000400000-0x000000000048B000-memory.dmp

Download

memory/4964-33-0x0000000000400000-0x000000000048B000-memory.dmp

Download

memory/5676-0-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/5676-1-0x000000000041B000-0x000000000041C000-memory.dmp

Download

memory/5676-24-0x0000000000400000-0x0000000000426000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads