Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 03:40
General
- Target jaffacakes118_Windows.xp.sp3.5512.gamer.edition.with.driverpacks.exe
- Size 4.3MB
- Sample260910-d8m6ksweje
- SHA256 48678ea975b7b0a42422761a2dede31c66175e47a794db621e3627c9e0f00b32
Malware Config
Signatures
- Detected Nirsoft tools 21 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 9 IoCs
- UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 46 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Windows.xp.sp3.5512.gamer.edition.with.driverpacks.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Windows.xp.sp3.5512.gamer.edition.with.driverpacks.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Windows.xp.sp3.5512.gamer.edition.with.driverpacks.exe/stext C:\Users\Admin\AppData\Local\Temp\temp.txt2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Windows.xp.sp3.5512.gamer.edition.with.driverpacks.exe/stext C:\Users\Admin\AppData\Local\Temp\temp.txt2⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Windows.xp.sp3.5512.gamer.edition.with.driverpacks.exe/stext C:\Users\Admin\AppData\Local\Temp\temp.txt2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Windows.xp.sp3.5512.gamer.edition.with.driverpacks.exe/stext C:\Users\Admin\AppData\Local\Temp\temp.txt2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Windows.xp.sp3.5512.gamer.edition.with.driverpacks.exe/stext C:\Users\Admin\AppData\Local\Temp\temp.txt2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Windows.xp.sp3.5512.gamer.edition.with.driverpacks.exe/stext C:\Users\Admin\AppData\Local\Temp\temp.txt2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Windows.xp.sp3.5512.gamer.edition.with.driverpacks.exe/stext C:\Users\Admin\AppData\Local\Temp\temp.txt2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Windows.xp.sp3.5512.gamer.edition.with.driverpacks.exe/stext C:\Users\Admin\AppData\Local\Temp\temp.txt2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Windows.xp.sp3.5512.gamer.edition.with.driverpacks.exe/stext C:\Users\Admin\AppData\Local\Temp\temp.txt2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
temp.txt
temp.txt
temp.txt
temp.txt
memory/1052-8-0x0000000000400000-0x000000000041D000-memory.dmp
memory/1052-10-0x0000000000400000-0x000000000041D000-memory.dmp
memory/1052-12-0x0000000000400000-0x000000000041D000-memory.dmp
memory/1052-11-0x0000000000400000-0x000000000041D000-memory.dmp
memory/1624-25-0x0000000000400000-0x0000000000415000-memory.dmp
memory/1624-22-0x0000000000400000-0x0000000000415000-memory.dmp
memory/1624-23-0x0000000000400000-0x0000000000414350-memory.dmp
memory/1624-26-0x0000000000400000-0x0000000000414350-memory.dmp
memory/1624-28-0x0000000000400000-0x0000000000415000-memory.dmp
memory/1624-30-0x0000000000400000-0x0000000000414350-memory.dmp
memory/2260-52-0x0000000000400000-0x0000000000406000-memory.dmp
memory/2260-53-0x0000000000400000-0x0000000000406000-memory.dmp
memory/2260-55-0x0000000000400000-0x0000000000406000-memory.dmp
memory/2324-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2324-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2324-32-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2380-41-0x0000000000400000-0x0000000000419000-memory.dmp
memory/2380-43-0x0000000000400000-0x0000000000419000-memory.dmp
memory/2380-38-0x0000000000400000-0x0000000000419000-memory.dmp
memory/2380-39-0x0000000000400000-0x0000000000419000-memory.dmp
memory/2380-40-0x0000000000400000-0x0000000000419000-memory.dmp
memory/2392-47-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2392-46-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2392-49-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3040-18-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3040-20-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3040-15-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3040-17-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4324-2-0x0000000000400000-0x0000000000425000-memory.dmp
memory/4324-7-0x0000000000400000-0x0000000000425000-memory.dmp
memory/4324-0-0x0000000000400000-0x0000000000425000-memory.dmp
memory/4324-3-0x0000000000400000-0x0000000000425000-memory.dmp
memory/4324-4-0x0000000000400000-0x0000000000425000-memory.dmp
memory/5008-64-0x0000000010000000-0x0000000010006000-memory.dmp
memory/5012-58-0x0000000000400000-0x000000000043D000-memory.dmp
memory/5012-60-0x0000000000400000-0x000000000043D000-memory.dmp
memory/5012-59-0x0000000000400000-0x000000000043D000-memory.dmp
memory/5012-63-0x0000000000400000-0x000000000043D000-memory.dmp