Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 09:49
General
- Target jaffacakes118_1c8dbbca3c23e7cdb2e77655422953975b1ef88234743ee97ded8e438f68735f.exe
- Size 2.6MB
- Sample260924-ltmkhas1cx
- SHA256 1c8dbbca3c23e7cdb2e77655422953975b1ef88234743ee97ded8e438f68735f
Malware Config
Signatures
- Detected Nirsoft tools 5 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft NirCmd 5 IoCs
NirCmd is a lightweight Windows command-line tool for automating system tasks
- Disables RegEdit via registry modification 2 IoCs
- Executes dropped EXE 13 IoCs
- Modifies system executable filetype association 2 TTPs 6 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in System32 directory 2 IoCs
- UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 11 IoCs
- Runs .reg file with regedit 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1c8dbbca3c23e7cdb2e77655422953975b1ef88234743ee97ded8e438f68735f.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1c8dbbca3c23e7cdb2e77655422953975b1ef88234743ee97ded8e438f68735f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\327882R2FWJFW\nircmd.com"C:\327882R2FWJFW\nircmd.com" shexec install 327882R2FWJFW\nircmd.inf2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\InfDefaultInstall.exe"C:\Windows\System32\InfDefaultInstall.exe" "C:\327882R2FWJFW\NirCmd.inf"3⤵
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\runonce.exe"C:\Windows\system32\runonce.exe" -r4⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\System32\grpconv.exe" -o5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\regedit.exe" /s 327882R2FWJFW\EXE.reg2⤵
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
- Runs .reg file with regedit
-
-
C:\327882R2FWJFW\nircmd.com"C:\327882R2FWJFW\nircmd.com" exec hide 327882R2FWJFW\prep.cmd >Bug.txt2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 327882R2FWJFW\prep.cmd >Bug.txt3⤵
- Drops file in System32 directory
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\327882R2FWJFW\pv.cfexepv -o"%i\t%l"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\327882R2FWJFW\sed.cfexeSED "/\t.*\\nircmd\.inf$/I!d; s///; s/./@pv -kfi &/"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\327882R2FWJFW\NirCmd.cfexeNircmd win close class "#32770"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\327882R2FWJFW\NirCmd.cfexeNircmd win close ititle "ComboFix"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\327882R2FWJFW\swreg.cfexeswreg add "hklm\software\microsoft\windows\currentversion\app paths\combofix.exe" /ve /d "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1c8dbbca3c23e7cdb2e77655422953975b1ef88234743ee97ded8e438f68735f.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\327882R2FWJFW\attrib.cfexeAttrib +r "C:\327882R2FWJFW\*.cfexe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\327882R2FWJFW\attrib.cfexeAttrib +r "C:\327882R2FWJFW\*.com"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\327882R2FWJFW\swxcacls.cfexeswxcacls "C:\Windows\system32\cmd.exe" /oa /Q4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\327882R2FWJFW\swxcacls.cfexeswxcacls "C:\Windows\system32\cmd.exe" /p /ga:f /gs:f /gp:x /gu:x /q4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\327882R2FWJFW\grep.cfexeGREP -Gisqx "FileName=[-[:alnum:]@.]*" FileName4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\327882R2FWJFW\NirCmd.cfexenircmd infobox "You cannot rename ComboFix as jaffacakes118_1c8dbbca3c23e7cdb2e77655422953975b1ef88234743ee97ded8e438f68735f~n~nPlease use another name, preferbaly made up of alphanumeric characters" ""4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\grpconv.exegrpconv -o1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
ERUNT.cfexe
Exe.reg
FileName
NirCmd.inf
NirCmdC.cfexe
SF.cfexe
attrib.cfexe
catchme.cfexe
dd.cfexe
dumphive.cfexe
extract.cfexe
fdsv.cfexe
grep.cfexe
gsar.cfexe
handle.cfexe
md5deep.cfexe
moveex.cfexe
mtee.cfexe
nircmd.com
prep.cmd
psexec.cfexe
pv.cfexe
sed.cfexe
setpath.cfexe
swreg.cfexe
swsc.cfexe
swxcacls.cfexe
vfind.cfexe
zip.cfexe
023.dat
023v.dat
Boot.bat
BootSect
C.bat
COMBO-~1.SYS
COMBOB~1.BAT
Comspec.bat
Creg.dat
CregC.cmd
CregC.dat
DISCLA~1.BAT
DPF.sed
DPF.str
DelClsid.bat
ERDNT.e_e
ERDNTDOS.LOC
ERDNTWIN.LOC
ERUNT.LOC
badclsid
clsid.dat
embedded.sed
memory/252-268-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1544-272-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2680-231-0x0000000000400000-0x000000000048B000-memory.dmp
memory/2680-230-0x0000000000400000-0x000000000048B000-memory.dmp
memory/3000-225-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3308-222-0x0000000000400000-0x0000000000421000-memory.dmp
memory/4184-270-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4212-227-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4356-213-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5240-208-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5240-205-0x0000000000412000-0x0000000000413000-memory.dmp
memory/5240-203-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5424-261-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5764-259-0x0000000000400000-0x000000000043E000-memory.dmp