6ebcc47c6fd348c9f17fb53985afca4cfe6300c0cc4d393c0755f60a59d0fdfb

Analysis

max time kernel
149s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_ICQ Spammer.exe
Size 919KB
Sample260910-errywafc89
SHA256 6ebcc47c6fd348c9f17fb53985afca4cfe6300c0cc4d393c0755f60a59d0fdfb
MD5 5339ea33da9368d0cd8f73d2e993b5a4
SHA1 f3783c228b2660b0082be3304f360836f17ceb5b
SHA512 113da2f500d7f79787916278dc8bbbddfdd64a3f7b83173a30cddd7db4eeabcd67579154b39ccaac896b1555d78b6008de0cab8616088de6a7dac0263150d0a3
SSDEEP 12288:Y1xLKqGCW2MjxYUCoUsRcF1uLl672UvXnHyMujJdrwBOX:OVNPfsRy1F7NHiXswX
TLSH
T13915CFDED16E44D2CC053FF9A8241AC75B2487728A74005839BFBD498F774FA805EEA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

Detected Nirsoft tools 2 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/files/0x000d00000001c5cf-17.dat	Nirsoft
behavioral2/memory/1016-42-0x0000000000400000-0x0000000000410000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/files/0x000d00000001c5cf-17.dat	MailPassView

Executes dropped EXE 10 IoCs

pid	Process
1388	244756.exe
3088	244756.exe
4340	244756.exe
932	244756.exe
4364	244756.exe
4600	244756.exe
1016	244756.exe
3280	244756.exe
2380	244756.exe
5412	244756.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 1388 set thread context of 3088	1388	244756.exe	90
PID 1388 set thread context of 4340	1388	244756.exe	91
PID 1388 set thread context of 932	1388	244756.exe	92
PID 1388 set thread context of 4364	1388	244756.exe	93
PID 1388 set thread context of 4600	1388	244756.exe	94
PID 1388 set thread context of 1016	1388	244756.exe	95
PID 1388 set thread context of 3280	1388	244756.exe	96
PID 1388 set thread context of 2380	1388	244756.exe	97
PID 1388 set thread context of 5412	1388	244756.exe	98

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3088-18-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral2/memory/4600-41-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/4364-36-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/2380-51-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/3280-50-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral2/memory/932-28-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/4340-24-0x0000000000400000-0x000000000041D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	244756.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 1388	4868	jaffacakes118_ICQ Spammer.exe	89
PID 1388 wrote to memory of 3088	1388	244756.exe	90
PID 1388 wrote to memory of 3088	1388	244756.exe	90
PID 1388 wrote to memory of 3088	1388	244756.exe	90
PID 1388 wrote to memory of 3088	1388	244756.exe	90
PID 1388 wrote to memory of 4340	1388	244756.exe	91
PID 1388 wrote to memory of 4340	1388	244756.exe	91
PID 1388 wrote to memory of 4340	1388	244756.exe	91
PID 1388 wrote to memory of 4340	1388	244756.exe	91
PID 1388 wrote to memory of 932	1388	244756.exe	92
PID 1388 wrote to memory of 932	1388	244756.exe	92
PID 1388 wrote to memory of 932	1388	244756.exe	92
PID 1388 wrote to memory of 932	1388	244756.exe	92
PID 1388 wrote to memory of 4364	1388	244756.exe	93
PID 1388 wrote to memory of 4364	1388	244756.exe	93
PID 1388 wrote to memory of 4364	1388	244756.exe	93
PID 1388 wrote to memory of 4364	1388	244756.exe	93
PID 1388 wrote to memory of 4600	1388	244756.exe	94
PID 1388 wrote to memory of 4600	1388	244756.exe	94
PID 1388 wrote to memory of 4600	1388	244756.exe	94
PID 1388 wrote to memory of 4600	1388	244756.exe	94
PID 1388 wrote to memory of 1016	1388	244756.exe	95
PID 1388 wrote to memory of 1016	1388	244756.exe	95
PID 1388 wrote to memory of 1016	1388	244756.exe	95
PID 1388 wrote to memory of 1016	1388	244756.exe	95
PID 1388 wrote to memory of 1016	1388	244756.exe	95
PID 1388 wrote to memory of 1016	1388	244756.exe	95
PID 1388 wrote to memory of 3280	1388	244756.exe	96
PID 1388 wrote to memory of 3280	1388	244756.exe	96
PID 1388 wrote to memory of 3280	1388	244756.exe	96
PID 1388 wrote to memory of 3280	1388	244756.exe	96
PID 1388 wrote to memory of 2380	1388	244756.exe	97
PID 1388 wrote to memory of 2380	1388	244756.exe	97
PID 1388 wrote to memory of 2380	1388	244756.exe	97
PID 1388 wrote to memory of 2380	1388	244756.exe	97
PID 1388 wrote to memory of 5412	1388	244756.exe	98
PID 1388 wrote to memory of 5412	1388	244756.exe	98
PID 1388 wrote to memory of 5412	1388	244756.exe	98
PID 1388 wrote to memory of 5412	1388	244756.exe	98
PID 1388 wrote to memory of 5412	1388	244756.exe	98

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ICQ Spammer.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ICQ Spammer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\244756.exe
  C:\Users\Admin\AppData\Local\Temp\244756.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Users\Admin\AppData\Local\Temp\244756.exe
    /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
    3⤵
    - Executes dropped EXE
    PID:3088
- - C:\Users\Admin\AppData\Local\Temp\244756.exe
    /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
    3⤵
    - Executes dropped EXE
    PID:4340
- - C:\Users\Admin\AppData\Local\Temp\244756.exe
    /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
    3⤵
    - Executes dropped EXE
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\244756.exe
    /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
    3⤵
    - Executes dropped EXE
    PID:4364
- - C:\Users\Admin\AppData\Local\Temp\244756.exe
    /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
    3⤵
    - Executes dropped EXE
    PID:4600
- - C:\Users\Admin\AppData\Local\Temp\244756.exe
    /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
    3⤵
    - Executes dropped EXE
    PID:1016
- - C:\Users\Admin\AppData\Local\Temp\244756.exe
    /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
    3⤵
    - Executes dropped EXE
    PID:3280
- - C:\Users\Admin\AppData\Local\Temp\244756.exe
    /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
    3⤵
    - Executes dropped EXE
    PID:2380
- - C:\Users\Admin\AppData\Local\Temp\244756.exe
    "C:\Users\Admin\AppData\Local\Temp\244756.exe"
    3⤵
    - Executes dropped EXE
    PID:5412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

244756.exe

Path C:\Users\Admin\AppData\Local\Temp\244756.exe
Size 443KB
SHA256 8d2915c203bc05d8479d6160d5dcbc0828d6b8e52be5e987bcae357ab8600f17
MD5 ecde0067cc525052fd1542d7df853264
SHA1 d5847eed2e0e7e72835b9ffcb531f910e768691e
SHA512 ec858b2d4b880193ed600e24568a4a77dcb75707b573f44d09f3872bfd903058f973db98443d21047772f62b5b14ae222f10701b52f5e8800e800cc0a298ddd9
SSDEEP 12288:79d4qI+imdk+kUgp/BmJ4e52AopF7tQiRHFqr:r40i+knpJmJ4e52AeFJHFm
TLSH
T18DA4CF17F7C185B6C4E74831011B16765AB4FA32C6215BABABD01D1EEE312D6FE3834A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/932-28-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/1016-42-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/1388-60-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/1388-67-0x0000000010000000-0x0000000010006000-memory.dmp

Download

memory/2380-51-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/3088-18-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3280-50-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/4340-24-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4364-36-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/4600-41-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4868-20-0x00007FFEE24D0000-0x00007FFEE2F08000-memory.dmp

Download

memory/4868-54-0x00007FFEE24D0000-0x00007FFEE2F08000-memory.dmp

Download

memory/4868-13-0x00007FFEE24D0000-0x00007FFEE2F08000-memory.dmp

Download

memory/4868-3-0x00007FFEE24D0000-0x00007FFEE2F08000-memory.dmp

Download

memory/4868-19-0x00007FFEE24D0000-0x00007FFEE2F08000-memory.dmp

Download

memory/4868-4-0x000000001BF40000-0x000000001BFDC000-memory.dmp

Download

memory/4868-11-0x00007FFEE24D0000-0x00007FFEE2F08000-memory.dmp

Download

memory/4868-10-0x00007FFEE24D0000-0x00007FFEE2F08000-memory.dmp

Download

memory/4868-9-0x00007FFEE24D0000-0x00007FFEE2F08000-memory.dmp

Download

memory/4868-6-0x000000001C0A0000-0x000000001C0EC000-memory.dmp

Download

memory/4868-0-0x00007FFEE27CA000-0x00007FFEE27CB000-memory.dmp

Download

memory/4868-65-0x00007FFEE24D0000-0x00007FFEE2F08000-memory.dmp

Download

memory/4868-8-0x00007FFEE24D0000-0x00007FFEE2F08000-memory.dmp

Download

memory/4868-12-0x00007FFEE24D0000-0x00007FFEE2F08000-memory.dmp

Download

memory/4868-7-0x00007FFEE24D0000-0x00007FFEE2F08000-memory.dmp

Download

memory/4868-2-0x000000001B980000-0x000000001BE4E000-memory.dmp

Download

memory/4868-1-0x000000001B3E0000-0x000000001B486000-memory.dmp

Download

memory/4868-5-0x0000000000F70000-0x0000000000F78000-memory.dmp

Download

memory/5412-56-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/5412-64-0x0000000000400000-0x0000000000410544-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads