Overview

overview

7

Static

static

3

jaffacakes...76.msi

windows10-2004-x64

7

jaffacakes...76.msi

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    64s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 09:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_e43b8d50114b3d33d2f25f24ed205ebdb410084aa2161ef65b1bf4e0f86d9676.msi
  • Size 35.9MB
  • Sample260924-lrs99sys6k
  • SHA256 e43b8d50114b3d33d2f25f24ed205ebdb410084aa2161ef65b1bf4e0f86d9676
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e43b8d50114b3d33d2f25f24ed205ebdb410084aa2161ef65b1bf4e0f86d9676.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2400
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1332
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5884
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 898B1857C5128777B507BC95C724E773 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5432
      • C:\Program Files (x86)\ErrorRepairTool\ErrorRepairTool.exe
        "C:\Program Files (x86)\ErrorRepairTool\ErrorRepairTool.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:5268
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3764
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:1464
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1412

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e5a4e32.rbs
            • Path C:\Config.Msi\e5a4e32.rbs
            • Size 9KB
            • SHA256 537a532301f3e767fbe67187fe0058bb9fdc1029cbe34d0be2eae620a205ab93
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ErrorRepairTool.exe
            • Path C:\Program Files (x86)\ErrorRepairTool\ErrorRepairTool.exe
            • Size 35.0MB
            • SHA256 88afb629c7f72cca5a47df3c6ac9d3e71eb1358f7f70feb3f07baeff0df552cf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            definitions.db
            • Path C:\Program Files (x86)\ErrorRepairTool\definitions.db
            • Size 31KB
            • SHA256 9b5907722c56251f22008607b367bf1700c0a3fe3da285d058401cfc5b495b41
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            privacy.db
            • Path C:\Program Files (x86)\ErrorRepairTool\privacy.db
            • Size 4KB
            • SHA256 58cbd605ee78c71c3f05644453dd7969742b8f3dd7379e0bc6885f9407538b17
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI60EE.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI60EE.tmp
            • Size 129KB
            • SHA256 05b91968786f32e933922ca8f4eb77a2b664d483b4d523beb32420eb953e5a23
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5a4e31.msi
            • Path C:\Windows\Installer\e5a4e31.msi
            • Size 35.9MB
            • SHA256 e43b8d50114b3d33d2f25f24ed205ebdb410084aa2161ef65b1bf4e0f86d9676
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ErrorRepairTool Scan.job
            • Path C:\Windows\Tasks\ErrorRepairTool Scan.job
            • Size 520B
            • SHA256 5bc1925f9b9a3aa346796a2e7539e50ea40f808b5e7cbfa119635c5eb57577b4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ErrorRepairTool Startup.job
            • Path C:\Windows\Tasks\ErrorRepairTool Startup.job
            • Size 460B
            • SHA256 d02fd965142eb9e9d8bc57ee899dc707839817533ad0849204f91c45415e80ca
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            metadata-2
            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
            • Size 26.1MB
            • SHA256 4b65e91ad427ac483314a26194e610044dc1e1d17203cc90085769e3ddeaff02
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {e7623645-cebf-43eb-9541-1f16943368be}_OnDiskSnapshotProp
            • Path \??\Volume{e35b4427-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{e7623645-cebf-43eb-9541-1f16943368be}_OnDiskSnapshotProp
            • Size 6KB
            • SHA256 c47694fa30adfd1e179cb56883cd9ad1dc6564c1920e0927c0b6532abcb030de
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download