Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 02:23
General
- Target jaffacakes118_adobe creative suite 3 master collection AngelEye Working at 24th November.exe
- Size 428KB
- Sample260910-cvhs9sef75
- SHA256 ccb90484fb60bafb99f9f8cd65b288a32d2891752c30f657d6c42aeee4fde07d
Malware Config
Signatures
- Detected Nirsoft tools 4 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
- Looks for VMWare drivers on disk 2 TTPs 1 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 5 IoCs
- UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 29 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_adobe creative suite 3 master collection AngelEye Working at 24th November.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_adobe creative suite 3 master collection AngelEye Working at 24th November.exe"1⤵
- Looks for VMWare drivers on disk
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_adobe creative suite 3 master collection AngelEye Working at 24th November.exe/stext C:\Users\Admin\AppData\Local\Temp\~tmp111.txt2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_adobe creative suite 3 master collection AngelEye Working at 24th November.exe/stext C:\Users\Admin\AppData\Local\Temp\~tmp112.tmp2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_adobe creative suite 3 master collection AngelEye Working at 24th November.exe/stext C:\Users\Admin\AppData\Local\Temp\~tmp113.tmp2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_adobe creative suite 3 master collection AngelEye Working at 24th November.exe/stext C:\Users\Admin\AppData\Local\Temp\~tmp114.tmp2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_adobe creative suite 3 master collection AngelEye Working at 24th November.exe/stext C:\Users\Admin\AppData\Local\Temp\~tmp115.tmp2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\sidebar.exe"C:\Users\Admin\AppData\Local\Temp\sidebar.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 2643⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1012 -ip 10121⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
sidebar.exe
~tmp159.tmp
memory/52-95-0x0000000002280000-0x00000000022BF000-memory.dmp
memory/52-85-0x0000000002280000-0x00000000022BF000-memory.dmp
memory/52-8-0x0000000002200000-0x000000000223F000-memory.dmp
memory/52-108-0x0000000000400000-0x000000000046B000-memory.dmp
memory/52-13-0x0000000002280000-0x000000000228A000-memory.dmp
memory/52-83-0x0000000010000000-0x0000000010012000-memory.dmp
memory/52-6-0x0000000010000000-0x0000000010012000-memory.dmp
memory/52-0-0x0000000000400000-0x000000000046B000-memory.dmp
memory/52-19-0x0000000002200000-0x000000000223F000-memory.dmp
memory/52-93-0x0000000002200000-0x000000000223F000-memory.dmp
memory/52-92-0x0000000010000000-0x0000000010012000-memory.dmp
memory/52-91-0x0000000000400000-0x000000000046B000-memory.dmp
memory/52-87-0x0000000002280000-0x00000000022BF000-memory.dmp
memory/52-7-0x0000000002250000-0x0000000002277000-memory.dmp
memory/52-90-0x0000000002280000-0x00000000022BF000-memory.dmp
memory/52-86-0x0000000002280000-0x00000000022BF000-memory.dmp
memory/1012-105-0x0000000000400000-0x0000000000407000-memory.dmp
memory/1012-107-0x0000000000400000-0x0000000000407000-memory.dmp
memory/3292-71-0x0000000000400000-0x0000000000419000-memory.dmp
memory/3292-73-0x0000000000400000-0x0000000000419000-memory.dmp
memory/3292-72-0x0000000000400000-0x0000000000419000-memory.dmp
memory/3356-59-0x0000000000400000-0x0000000000412000-memory.dmp
memory/3356-62-0x0000000000400000-0x0000000000412000-memory.dmp
memory/3356-61-0x0000000000400000-0x0000000000412000-memory.dmp
memory/3356-60-0x0000000000400000-0x0000000000412000-memory.dmp
memory/4612-46-0x0000000000400000-0x0000000000418000-memory.dmp
memory/4612-45-0x0000000000400000-0x0000000000418000-memory.dmp
memory/4612-47-0x0000000000400000-0x0000000000418000-memory.dmp
memory/4612-48-0x0000000000400000-0x0000000000418000-memory.dmp
memory/4884-24-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4884-20-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4884-21-0x0000000000400000-0x000000000041F000-memory.dmp
memory/4884-22-0x0000000000400000-0x000000000041F000-memory.dmp
memory/6612-36-0x0000000000400000-0x0000000000419000-memory.dmp
memory/6612-35-0x0000000000400000-0x0000000000419000-memory.dmp
memory/6612-33-0x0000000000400000-0x0000000000419000-memory.dmp
memory/6612-34-0x0000000000400000-0x0000000000419000-memory.dmp