30e99974c22bdd01aaf779f5fc8f9e1fa9eff68fe7add25e1a28e88dd2583689 | Triage™

Login
Reports

Overview

overview

8

Static

static

7

IMG001.scr

windows10-2004-x64

3

IMG001.scr

windows11-ltsc_2024-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

$PLUGINSDI...os.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/inetc.dll

windows10-2004-x64

3

$PLUGINSDIR/inetc.dll

windows11-ltsc_2024-x64

3

$R9/NsCpuC...64.exe

windows10-2004-x64

7

$R9/NsCpuC...64.exe

windows11-ltsc_2024-x64

7

$R9/Plugin...os.dll

windows10-2004-x64

3

$R9/Plugin...os.dll

windows11-ltsc_2024-x64

3

$R9/Plugins/inetc.dll

windows10-2004-x64

3

$R9/Plugins/inetc.dll

windows11-ltsc_2024-x64

3

$R9/Plugins/tftp.exe

windows10-2004-x64

8

$R9/Plugins/tftp.exe

windows11-ltsc_2024-x64

8

$R9/Stubs/bzip2.exe

windows10-2004-x64

3

$R9/Stubs/bzip2.exe

windows11-ltsc_2024-x64

3

$R9/Stubs/...id.exe

windows10-2004-x64

3

$R9/Stubs/...id.exe

windows11-ltsc_2024-x64

3

$R9/Stubs/lzma.exe

windows10-2004-x64

3

$R9/Stubs/lzma.exe

windows11-ltsc_2024-x64

3

$R9/Stubs/zlib.exe

windows10-2004-x64

3

$R9/Stubs/zlib.exe

windows11-ltsc_2024-x64

3

$R9/makensis.exe

windows10-2004-x64

3

$R9/makensis.exe

windows11-ltsc_2024-x64

3

information.vbe

windows10-2004-x64

7

information.vbe

windows11-ltsc_2024-x64

5

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_30e99974c22bdd01aaf779f5fc8f9e1fa9eff68fe7add25e1a28e88dd2583689.bin
Size 3.4MB
Sample260912-lzw15ahd48
SHA256 30e99974c22bdd01aaf779f5fc8f9e1fa9eff68fe7add25e1a28e88dd2583689
MD5 ac01f9340f7795533d56debd2e8e4550
SHA1 7c65b3ad5ec51b5ff84f398bc1241b202ea713e4
SHA512 447441856f0bde4c374f73af8b7019e15aba0cd5f78184a6907ba56994d6369148248b8ec90317eb200ce8dcaaeb6f8d6381f7e1a07d4699f8c4bc8cc55532e1
SSDEEP 98304:SyrPvG3UNpZqQLpXhHHeanDebmPL+okjWa1lu/:SyrPO3UDfdXp+z8+FWyE
TLSH
T1AEF53329C34BA51D444DD111B88E299A937D8D177E1E17314E4333ACFE378AE3E8E2A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution installer vmprotect

Static task

static1

3 signatures

installer vmprotect

Behavioral task

behavioral1

Sample

IMG001.scr

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

IMG001.scr

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

$PLUGINSDIR/ExecDos.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral4

Sample

$PLUGINSDIR/ExecDos.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral5

Sample

$PLUGINSDIR/inetc.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

$PLUGINSDIR/inetc.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral7

Sample

$R9/NsCpuCNMiner64.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

$R9/NsCpuCNMiner64.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral9

Sample

$R9/Plugins/ExecDos.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral10

Sample

$R9/Plugins/ExecDos.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral11

Sample

$R9/Plugins/inetc.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral12

Sample

$R9/Plugins/inetc.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral13

Sample

$R9/Plugins/tftp.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

$R9/Plugins/tftp.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral15

Sample

$R9/Stubs/bzip2.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral16

Sample

$R9/Stubs/bzip2.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral17

Sample

$R9/Stubs/bzip2_solid.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral18

Sample

$R9/Stubs/bzip2_solid.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral19

Sample

$R9/Stubs/lzma.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral20

Sample

$R9/Stubs/lzma.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral21

Sample

$R9/Stubs/zlib.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral22

Sample

$R9/Stubs/zlib.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral23

Sample

$R9/makensis.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

$R9/makensis.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral25

Sample

information.vbe

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral26

Sample

information.vbe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Malware Config

Targets

- Target
  IMG001.scr
- Size 3.4MB
- SHA256 983aa8790b172c2d4051f595b250ee4a0014231f60ca60efecabafe1cfe2ccff
- MD5 03f7c7ba4579728daa2bb9df87bf8d8e
- SHA1 f83c2c52ffc7d35617da96972634fb0bfc4278fe
- SHA512 e495a2a596a8d9ffc033215863728786a923adc4bd1e06f566739ad220e50851c7ab79b9e251ab2253ed9aa994dc11fa3b0eb7fc2c33068e1a3e66a6961bb7e7
- SSDEEP 98304:M5VPnq1y5t7OM33ZNqCtBixHl54Oyjes1Ro6:2VPq1yLfnrqTr43eON
- TLSH
  T18DF533259387802DC0498230788B2B66E37ACC173D0917625F4277ADFE374EB7E8E656
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/ExecDos.dll
- Size 6KB
- SHA256 42422d912b9c626ad93eb8c036ad82ee67cfa48cf75259c20c327eddd4cc376f
- MD5 d7b975049ec3aba50e4b7cc654a28214
- SHA1 25f2578945ebc9ac037fef7b7f94c5d48e42388b
- SHA512 f95f7875aeab586d42ee48029f7feed6e2fd8a7d106671e225ff5cf9ad83375f0ec3b8b288177c5d48b4c51eeddde687d67e7b07ad324e24059cff0a6516c270
- SSDEEP 96:31pNOe2w5QbJHsBiyw4uM4jEFVliuOtac32FOeSMV7WhWD:dj5Qb1sBPuijiu6avTyhW
- TLSH
  T18DD1B5797BE040B3D2B647303D72526793BDFC200B25E2AA4B571ACD2C90D54FD21BAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/inetc.dll
- Size 21KB
- SHA256 67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
- MD5 d7a3fa6a6c738b4a3c40d5602af20b08
- SHA1 34fc75d97f640609cb6cadb001da2cb2c0b3538a
- SHA512 75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934
- SSDEEP 384:oW4gLK82JvtosNCPhXKJ18hcEP1+f+pvMPbkdTg1Zahzs60Ac9khYLMkIX0+Gbyk:oW4i/2JloB5IQ9AhkwZaKRu
- TLSH
  T12DA207425B414AF3D3B60634707A33630769FE72246655DB86F32AC97878393EE36722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $R9/NsCpuCNMiner64.exe
- Size 1.5MB
- SHA256 d0326f0ddce4c00f93682e3a6f55a3125f6387e959e9ed6c5e5584e78e737078
- MD5 eedb9d86ae8abc65fa7ac7c6323d4e8f
- SHA1 ce1fbf382e89146ea5a22ae551b68198c45f40e4
- SHA512 9de3390197a02965feed6acdc77a292c0ef160e466fbfc9500fa7de17b0225a935127da71029cb8006bc7a5f4b5457319362b7a7caf4c0bf92174d139ed52ab5
- SSDEEP 24576:Mf79KQimeoyEgM8dSGDeCAQ4GYwEkYEDI3BiiVzKJo23bvH5xh8wtDzgClYAdC51:b3EciPG9E/LBVeJo2Vsw57lYAA51
- TLSH
  T12C7533DB854E31CBC243C770A5FF1E641022274AD1209349E37A279E8A9F2E5B7D9E74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

vmprotect
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral7 behavioral8
- Target
  $R9/Plugins/ExecDos.dll
- Size 6KB
- SHA256 42422d912b9c626ad93eb8c036ad82ee67cfa48cf75259c20c327eddd4cc376f
- MD5 d7b975049ec3aba50e4b7cc654a28214
- SHA1 25f2578945ebc9ac037fef7b7f94c5d48e42388b
- SHA512 f95f7875aeab586d42ee48029f7feed6e2fd8a7d106671e225ff5cf9ad83375f0ec3b8b288177c5d48b4c51eeddde687d67e7b07ad324e24059cff0a6516c270
- SSDEEP 96:31pNOe2w5QbJHsBiyw4uM4jEFVliuOtac32FOeSMV7WhWD:dj5Qb1sBPuijiu6avTyhW
- TLSH
  T18DD1B5797BE040B3D2B647303D72526793BDFC200B25E2AA4B571ACD2C90D54FD21BAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $R9/Plugins/inetc.dll
- Size 21KB
- SHA256 67eff17c53a78c8ec9a28f392b9bb93df3e74f96f6ecd87a333a482c36546b3e
- MD5 d7a3fa6a6c738b4a3c40d5602af20b08
- SHA1 34fc75d97f640609cb6cadb001da2cb2c0b3538a
- SHA512 75cf123448567806be5f852ebf70f398da881e89994b82442a1f4bc6799894e799f979f5ab1cc9ba12617e48620e6c34f71e23259da498da37354e5fd3c0f934
- SSDEEP 384:oW4gLK82JvtosNCPhXKJ18hcEP1+f+pvMPbkdTg1Zahzs60Ac9khYLMkIX0+Gbyk:oW4i/2JloB5IQ9AhkwZaKRu
- TLSH
  T12DA207425B414AF3D3B60634707A33630769FE72246655DB86F32AC97878393EE36722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $R9/Plugins/tftp.exe
- Size 95KB
- SHA256 73ddf0df4e9e3866511ef9eae421b11615b81491d0db1d4a7ed19441e368ecef
- MD5 21e42b4fdb800644335dd8cc95826c7b
- SHA1 23ec304fab33af1cacf0a167aeb7465631286128
- SHA512 7fe97cc38afea51b8b8776c860d49d3cac92df63f6acd4f647056a6210288ac387d499e8f6f281cdd31d73e6f1218bc08baa696b0c7c8d33d55543875c1be7b6
- SSDEEP 1536:NW7lchydMBUxt/lP8KB1R88EKaoLQWAmcTGI7Unt:MChye+x38KrRLMUnt
- TLSH
  T123931B95FF4700F0EE1706F014ABE76E6632E501983A9DEED7C95E439CE1E92044C6AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery
- Contacts a large (1061) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
behavioral13 behavioral14
- Target
  $R9/Stubs/bzip2
- Size 34KB
- SHA256 a32a41c520aa1d08d8e5cbc18c1994f92d47bede5cb8d3aca761579d242d249d
- MD5 7ac2315d458a6c78f81f7167b164ef37
- SHA1 f501956f346fe7ac49454f5eae54907eeb247f1d
- SHA512 00802299e1161ac3a3849678a0515e2ed4548a9c1397635fb546683a525f2dbaab8b90875d81821bc66b76c6669a309922284e818f510fb0d81d0c317458919b
- SSDEEP 768:FqVnDX38+t1ehxQ7unyskUplx3tUeLTjWfgeOVGM4jjfS3XJvai:kjs+t1ehxQuntkULceeM4sXJz
- TLSH
  T131F27D1622F1887BF5B6073149B7BB36F7BBD600011155636B742FAB2D31243DE2A28E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $R9/Stubs/bzip2_solid
- Size 34KB
- SHA256 5a9ecc6d9dbd32c54507496f022ecca949e18235bb0865e1aa345eb84e6af0cf
- MD5 0a108faf2f740e2b1a97d64985fdd1b4
- SHA1 e349e668f756ea4b9460bcb2be54504dc357d3d1
- SHA512 3f27d919d40dfbd431c1516a8803178d5e699f91856e8f9616b7f3fdc755af863f25c29cf08191775ab04d1457a0db8741e1697a66bd2c84252de58942c16faf
- SSDEEP 768:/Jyky/Nki4Q/JRQ/RZ49ylKR2e7jbEcIKFvGmjXO3XJOai:hiki4Q/JR2RZ49A1ecjXJ+
- TLSH
  T1CAF27D1661F1C87BF5AA473249B3BB3AF7B7D600051156531B602F6B6E31243DE2B28E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $R9/Stubs/lzma
- Size 33KB
- SHA256 b72d402fce699b21bbf0a4a86ab9fb7f8a083aeacd4f797be7a7f6f91ef93d62
- MD5 9557ea4608e64b857c1125eb41ba7429
- SHA1 d7276eccc032919c84fc05f206d3cdd0b40fe1fb
- SHA512 8eb238cd34668c12779553b7ef15cbeb4d8dd7aac36b5f044c680b83b04f7e2564905625e14ae5c5e06e4e9b5ccdb1663a08aa63a95e176266d59924061a6ce8
- SSDEEP 768:/ip/4K0wirQK33PaH81Fej4w0kGvFONg4jjfS3XJWai:6Zr0wirt3/aEecbsg4sXJW
- TLSH
  T11BF25B9636F1843BE55607304AB7EB7AFBB7A200162156576F601F7E3D21282CE1938F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $R9/Stubs/zlib
- Size 35KB
- SHA256 c96383fe97a213140741bf5df71f322753200c094cb22db634e050d2be744a4f
- MD5 346d3c8665f307a06aba85f8745360e8
- SHA1 de87ba7e2553f0efd531d30d6a5997dab9a6bc2f
- SHA512 6d9910251618226bfd94c94661b86db0b6c07d5dbc5445cbd0ae7bd34fc42e0b2af53fbd14b57969cda9deb747dae7837209eb4c61b4b130b0170f584b839aa2
- SSDEEP 768:x0gFJMBrbxJQJFiXDYwQ5NTdKqP5sCOfZ7jrG0D3cjfS3XJQai:xfYBrbzmFizYwUK1G0DRXJQ
- TLSH
  T142F28E06B7F1897BE596473105B3BB7AFBBBC10016211A035BB41FBE3C612839D1A24E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $R9/makensis.exe
- Size 484KB
- SHA256 572a6f9cb5b37b6eec13b578d346c2568ce3ec88bb711d75dac9e82fc01c8860
- MD5 e79833cb0d7b2573819ded2122b57bdd
- SHA1 71ead8cd4a95704a0cade630bb3ce280af7e028e
- SHA512 4b023e60392ead0691621a1306286fda6cdc4c447f164c8f249c59db2500d8b98514d93c7a7e8d3cfd60818d2ca74e84ec24163492765b6c17fe94ea0385bd69
- SSDEEP 12288:LhHlj+wtKJVIo9ZoACV6sil8+eSycI+Tt0XCyzLHWj:Lxl+0KJVpneV6siy+I+TtcCyzLHW
- TLSH
  T178B4AF117DB580B5CD46B1B00DBE9B767678D6960B228BC3B7C4DD382E234B1A33725A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  information.vbe
- Size 1KB
- SHA256 30daba44a4a25ff5750508613f897057a55337458f19b562e2ed1172c77e626b
- MD5 e9ffdb716af3d355b25096a8ed4de8ef
- SHA1 66e2b15ba4dbfa127c3ec86abce666870a4a168a
- SHA512 f157dc99dfd4c1bec37deba85ed5250f70e169ab2d21b2c75d7d94b4463608c3c74ed9ab773e1359735cb95cb1f38333887d3c8e65c80c0cdfeee8bcb0d019f3
- TLSH
  T100211A74D35187803E819BC6DAA41AA01099AF73375C674F74E6CD650B0123CD5CC92D
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Visual Basic

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

installervmprotect

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

© 2018-2026

Terms | Privacy