Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/09/2026, 11:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_b6e4c871fb0db670703eb9a1f265de6e246b33a145508ea361c71c41183d7d2a.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_b6e4c871fb0db670703eb9a1f265de6e246b33a145508ea361c71c41183d7d2a.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target jaffacakes118_b6e4c871fb0db670703eb9a1f265de6e246b33a145508ea361c71c41183d7d2a.msi
- Size 5.5MB
- Sample260912-nlhbxsysds
- SHA256 b6e4c871fb0db670703eb9a1f265de6e246b33a145508ea361c71c41183d7d2a
- MD5 b8de7997021f0b480d7052b6abf9ba59
- SHA1 aa060723d82199099f14efcf6727fa5b89c4f920
- SHA512 7f0708282fee117ea6fcea1d317097feb6940e5a997f8638f228d4ce2b8cc38ca5c261b2d61c6c20666e349fa222c48f20cc87c35ae11718dc48ed89d8bbdbe9
- SSDEEP 98304:lpYhM0Ge0rwpbBpBWyVGXOPn+DucXBn4G38gqn2g8:uM0dM4bky8XYn+Xuy87L8
- TLSH T1FA4634D13744C527C9AB1A320E57D39A6728FD91AE30B08B3360FB5E1B799E35E24352
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2680 setup6212.exe - Loads dropped DLL 2 IoCs
pid Process 252 MsiExec.exe 252 MsiExec.exe - Modifies file permissions 1 TTPs 1 IoCs
pid Process 2388 ICACLS.EXE - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\Installer\SourceHash{D4941129-1FF4-454F-BD83-9E9CDD262C9B} msiexec.exe File created C:\Windows\SystemTemp\~DF1373215982C86CE5.TMP msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF7E813C61DB00CA09.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI28D6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI28E7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2E28.tmp msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setuperr.log EXPAND.EXE File created C:\Windows\Installer\e5a27bd.msi msiexec.exe File opened for modification C:\Windows\Installer\e5a27bd.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\LOGS\DPX\setupact.log EXPAND.EXE - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4472 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICACLS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXPAND.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup6212.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\uc1458813886v.lxs setup6212.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\uc1458813886v.lxs\ = 5861ad2daa3458900cd55b2307185c4d166356f2e508ac9e setup6212.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5796 msiexec.exe 5796 msiexec.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeShutdownPrivilege 4472 msiexec.exe Token: SeIncreaseQuotaPrivilege 4472 msiexec.exe Token: SeSecurityPrivilege 5796 msiexec.exe Token: SeCreateTokenPrivilege 4472 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4472 msiexec.exe Token: SeLockMemoryPrivilege 4472 msiexec.exe Token: SeIncreaseQuotaPrivilege 4472 msiexec.exe Token: SeMachineAccountPrivilege 4472 msiexec.exe Token: SeTcbPrivilege 4472 msiexec.exe Token: SeSecurityPrivilege 4472 msiexec.exe Token: SeTakeOwnershipPrivilege 4472 msiexec.exe Token: SeLoadDriverPrivilege 4472 msiexec.exe Token: SeSystemProfilePrivilege 4472 msiexec.exe Token: SeSystemtimePrivilege 4472 msiexec.exe Token: SeProfSingleProcessPrivilege 4472 msiexec.exe Token: SeIncBasePriorityPrivilege 4472 msiexec.exe Token: SeCreatePagefilePrivilege 4472 msiexec.exe Token: SeCreatePermanentPrivilege 4472 msiexec.exe Token: SeBackupPrivilege 4472 msiexec.exe Token: SeRestorePrivilege 4472 msiexec.exe Token: SeShutdownPrivilege 4472 msiexec.exe Token: SeDebugPrivilege 4472 msiexec.exe Token: SeAuditPrivilege 4472 msiexec.exe Token: SeSystemEnvironmentPrivilege 4472 msiexec.exe Token: SeChangeNotifyPrivilege 4472 msiexec.exe Token: SeRemoteShutdownPrivilege 4472 msiexec.exe Token: SeUndockPrivilege 4472 msiexec.exe Token: SeSyncAgentPrivilege 4472 msiexec.exe Token: SeEnableDelegationPrivilege 4472 msiexec.exe Token: SeManageVolumePrivilege 4472 msiexec.exe Token: SeImpersonatePrivilege 4472 msiexec.exe Token: SeCreateGlobalPrivilege 4472 msiexec.exe Token: SeBackupPrivilege 5216 vssvc.exe Token: SeRestorePrivilege 5216 vssvc.exe Token: SeAuditPrivilege 5216 vssvc.exe Token: SeRestorePrivilege 5796 msiexec.exe Token: SeTakeOwnershipPrivilege 5796 msiexec.exe Token: SeRestorePrivilege 5796 msiexec.exe Token: SeTakeOwnershipPrivilege 5796 msiexec.exe Token: SeRestorePrivilege 5796 msiexec.exe Token: SeTakeOwnershipPrivilege 5796 msiexec.exe Token: SeRestorePrivilege 5796 msiexec.exe Token: SeTakeOwnershipPrivilege 5796 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4472 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4472 msiexec.exe 5796 msiexec.exe 252 MsiExec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5796 wrote to memory of 252 5796 msiexec.exe 89 PID 252 wrote to memory of 2388 252 MsiExec.exe 90 PID 252 wrote to memory of 5868 252 MsiExec.exe 92 PID 252 wrote to memory of 2680 252 MsiExec.exe 94 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b6e4c871fb0db670703eb9a1f265de6e246b33a145508ea361c71c41183d7d2a.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4472
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7EB012F04B567FA5E09A90F82E6581C52⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-9ec27686-6488-426d-8d5c-03802c440224\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:2388
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5868
-
-
C:\Users\Admin\AppData\Local\Temp\MW-9ec27686-6488-426d-8d5c-03802c440224\files\setup6212.exe"C:\Users\Admin\AppData\Local\Temp\MW-9ec27686-6488-426d-8d5c-03802c440224\files\setup6212.exe" /quiet /quiet3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2680
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5216
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MW-9ec27686-6488-426d-8d5c-03802c440224\files.cab
- Size 5.3MB
- SHA256 0ac3abea2e0328ad6ac118dd528b431feef5b6f2a2fafe72492ffcbcab162d25
- MD5 87ffb499d8bb651cdf50c4a288337bdf
- SHA1 b18cb63249f396689a97631d0ca714d16d7720b4
- SHA512 63edfae687f483cb6761c4d8abb952f6a3bcb11596310418b8f7f4f6ab0a0ec9cb4745c8da84b7d6200ecc59a186c4e78818306e71c0042727f65e73d9899c91
- SSDEEP 98304:KhM0Ge0rwpbBpBWyVGXOPn+DucXBn4G38gqn2g89:0M0dM4bky8XYn+Xuy87L89
- TLSH T16E4633D93710D507CDA76E210F43D39AAB18ED81BA7434073371F74E27BA8A24E68796
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MW-9ec27686-6488-426d-8d5c-03802c440224\msiwrapper.ini
- Size 1KB
- SHA256 9e9acd1141cd33047feaac67e7c2560f8b5862975951b904cfc09cb96b37e5dd
- MD5 261cd398e93a2f55a5ba91b10dd4cf7c
- SHA1 949aad3d1eedf1ff6febc6e34eb955b14a0dcfd6
- SHA512 3ef6b024eb22021fe3212bee321e866bbb5727f15c8bc458e62225e94ac5eaee74fd740f7eebcda20380aa8cbf41e8c7b927e2bc0938c33dfed6ce9fa34538b7
- TLSH T10021FB5DBBE90016A3F3DD95EEF890927E6678222D10EC0D51C4424D09B2E46FDB3729
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI28E7.tmp
- Size 208KB
- SHA256 fd622cf73ea951a6de631063aba856487d77745dd1500adca61902b8dde56fe1
- MD5 0c8921bbcc37c6efd34faf44cf3b0cb5
- SHA1 dcfa71246157edcd09eecaf9d4c5e360b24b3e49
- SHA512 ed55443e20d40cca90596f0a0542fa5ab83fe0270399adfaafd172987fb813dfd44ec0da0a58c096af3641003f830341fe259ad5bce9823f238ae63b7e11e108
- SSDEEP 3072:xspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCL42loHUvU0yGxr5GqM2a8:jtOdiRQYpgjpjew5DHyGxcqo8
- TLSH T1F1246CA13AC9C13AD2AE153785BA9766367A75751B30D0CFBB900C6C9A307D3ED39312
- MD5 SHA1 SHA512 SSDEEP TLSH