Analysis
- max time kernel
103s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 02:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe
- Size 396KB
- Sample260924-c7cssacd28
- SHA256 961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7
- MD5 b08a2f6f3f273ffe99c06e10c69fd0a7
- SHA1 9faa151eb729f6f716604ed7c0bff2ef7a6221b3
- SHA512 ff9be9b6fcafa0c7bd85d46f2a3d8386b254f8e76bb43c14ef79a76778e2e1a15f55cbc7a001a6ad5994cf089a66823ffc5281c0315b83cdfcf7304c077e050c
- SSDEEP 12288:jurpcmTzm7gBauiOZJn2eED6yj6SMxbi11/aPgKGV7D6nTi:M4bDXWSIu11i4KGVY
- TLSH T1C884F8EDE242E8CEF8B075350BF32EE05D55485EA70F1AC0A67BE42BBCAD61D512494C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4864 Nsesya.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job Nsesya.exe File created C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe File opened for modification C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe File created C:\Windows\Nsesya.exe jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe File created C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job Nsesya.exe - Program crash 1 IoCs
pid pid_target Process procid_target 41500 4864 WerFault.exe 88 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nsesya.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main Nsesya.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe 4864 Nsesya.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4600 jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe 4864 Nsesya.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4600 wrote to memory of 4864 4600 jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\Nsesya.exeC:\Windows\Nsesya.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:4864 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 7603⤵
- Program crash
PID:41500
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4864 -ip 48641⤵PID:41472
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Nsesya.exe
- Size 396KB
- SHA256 961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7
- MD5 b08a2f6f3f273ffe99c06e10c69fd0a7
- SHA1 9faa151eb729f6f716604ed7c0bff2ef7a6221b3
- SHA512 ff9be9b6fcafa0c7bd85d46f2a3d8386b254f8e76bb43c14ef79a76778e2e1a15f55cbc7a001a6ad5994cf089a66823ffc5281c0315b83cdfcf7304c077e050c
- SSDEEP 12288:jurpcmTzm7gBauiOZJn2eED6yj6SMxbi11/aPgKGV7D6nTi:M4bDXWSIu11i4KGVY
- TLSH T1C884F8EDE242E8CEF8B075350BF32EE05D55485EA70F1AC0A67BE42BBCAD61D512494C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
- Size 454B
- SHA256 cecd79c566619294c3044c27c5eb971809acc02b399058e42a2aeed76981dcb2
- MD5 c410e34f4add6d1e1e61888185bad234
- SHA1 fb867af9836ac630175586751a43e6e671eff660
- SHA512 d4ab485eb5e0ec059d9afd480d725364bbd7c37124e5008e3fc90db0e8b88c55f91e1cf30b9dcedd17c3b5de3744422e9c82c2190f3a62fd9ff62ce7a77eb040
- TLSH T122F0262EAAD26062D773A6341AF2C3A25FB4F1233D124B4E20C4474D0E63E266F8360C
- MD5 SHA1 SHA512 TLSH