Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 02:23
General
- Target jaffacakes118_adobe creative suite 3 master collection AngelEye Working at 24th November.exe
- Size 428KB
- Sample260910-cvhs9sef75
- SHA256 ccb90484fb60bafb99f9f8cd65b288a32d2891752c30f657d6c42aeee4fde07d
Malware Config
Signatures
- Detected Nirsoft tools 16 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
- Looks for VMWare drivers on disk 2 TTPs 1 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 5 IoCs
- UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 29 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_adobe creative suite 3 master collection AngelEye Working at 24th November.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_adobe creative suite 3 master collection AngelEye Working at 24th November.exe"1⤵
- Looks for VMWare drivers on disk
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_adobe creative suite 3 master collection AngelEye Working at 24th November.exe/stext C:\Users\Admin\AppData\Local\Temp\~tmp111.txt2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_adobe creative suite 3 master collection AngelEye Working at 24th November.exe/stext C:\Users\Admin\AppData\Local\Temp\~tmp112.tmp2⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_adobe creative suite 3 master collection AngelEye Working at 24th November.exe/stext C:\Users\Admin\AppData\Local\Temp\~tmp113.tmp2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_adobe creative suite 3 master collection AngelEye Working at 24th November.exe/stext C:\Users\Admin\AppData\Local\Temp\~tmp114.tmp2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_adobe creative suite 3 master collection AngelEye Working at 24th November.exe/stext C:\Users\Admin\AppData\Local\Temp\~tmp115.tmp2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\sidebar.exe"C:\Users\Admin\AppData\Local\Temp\sidebar.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 2523⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5016 -ip 50161⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
sidebar.exe
~tmp115.tmp
~tmp159.tmp
memory/2464-102-0x0000000010000000-0x0000000010012000-memory.dmp
memory/2464-97-0x0000000001FD0000-0x000000000200F000-memory.dmp
memory/2464-19-0x0000000001FD0000-0x000000000200F000-memory.dmp
memory/2464-103-0x0000000001FD0000-0x000000000200F000-memory.dmp
memory/2464-101-0x0000000000400000-0x000000000046B000-memory.dmp
memory/2464-0-0x0000000000400000-0x000000000046B000-memory.dmp
memory/2464-94-0x0000000010000000-0x0000000010012000-memory.dmp
memory/2464-117-0x0000000000400000-0x000000000046B000-memory.dmp
memory/2464-98-0x0000000001FD0000-0x000000000200F000-memory.dmp
memory/2464-95-0x0000000001FD0000-0x000000000200F000-memory.dmp
memory/2464-6-0x0000000001F90000-0x0000000001FB7000-memory.dmp
memory/2464-7-0x0000000001FD0000-0x000000000200F000-memory.dmp
memory/2464-12-0x0000000010000000-0x0000000010012000-memory.dmp
memory/2464-13-0x0000000002020000-0x000000000202A000-memory.dmp
memory/3324-46-0x0000000000400000-0x0000000000418000-memory.dmp
memory/3324-67-0x0000000000400000-0x0000000000418000-memory.dmp
memory/3324-86-0x0000000000400000-0x0000000000418000-memory.dmp
memory/3324-47-0x0000000000400000-0x0000000000418000-memory.dmp
memory/3324-45-0x0000000000400000-0x0000000000418000-memory.dmp
memory/3324-44-0x0000000000400000-0x0000000000418000-memory.dmp
memory/3716-33-0x0000000000400000-0x0000000000419000-memory.dmp
memory/3716-34-0x0000000000400000-0x0000000000419000-memory.dmp
memory/3716-42-0x0000000000400000-0x0000000000419000-memory.dmp
memory/3716-78-0x0000000000400000-0x0000000000419000-memory.dmp
memory/3716-31-0x0000000000400000-0x0000000000419000-memory.dmp
memory/3716-32-0x0000000000400000-0x0000000000419000-memory.dmp
memory/4116-21-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4116-20-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4116-77-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4116-23-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4116-22-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4116-43-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4472-74-0x0000000000400000-0x0000000000419000-memory.dmp
memory/4472-69-0x0000000000400000-0x0000000000419000-memory.dmp
memory/4472-84-0x0000000000400000-0x0000000000419000-memory.dmp
memory/4472-70-0x0000000000400000-0x0000000000419000-memory.dmp
memory/4472-73-0x0000000000400000-0x0000000000419000-memory.dmp
memory/4472-68-0x0000000000400000-0x0000000000419000-memory.dmp
memory/4472-75-0x0000000000400000-0x0000000000419000-memory.dmp
memory/4472-79-0x0000000000400000-0x0000000000419000-memory.dmp
memory/4480-56-0x0000000000400000-0x0000000000412000-memory.dmp
memory/4480-55-0x0000000000400000-0x0000000000412000-memory.dmp
memory/4480-76-0x0000000000400000-0x0000000000412000-memory.dmp
memory/4480-58-0x0000000000400000-0x0000000000412000-memory.dmp
memory/4480-57-0x0000000000400000-0x0000000000412000-memory.dmp
memory/4480-66-0x0000000000400000-0x0000000000412000-memory.dmp
memory/5016-114-0x0000000000400000-0x0000000000407000-memory.dmp
memory/5016-116-0x0000000000400000-0x0000000000407000-memory.dmp