Analysis
- max time kernel
16s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
25/09/2026, 18:40
General
- Target jaffacakes118_8e9c4bf1ee5aab00477ed86064d911c06c75886bac96ad06147a3b3132191b81.exe
- Size 33KB
- Sample260925-xa78msxvbv
- SHA256 8e9c4bf1ee5aab00477ed86064d911c06c75886bac96ad06147a3b3132191b81
Malware Config
Signatures
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 8 IoCs
- Adds Run key to start application 2 TTPs 8 IoCs
- Drops file in System32 directory 15 IoCs
- Drops file in Windows directory 23 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8e9c4bf1ee5aab00477ed86064d911c06c75886bac96ad06147a3b3132191b81.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8e9c4bf1ee5aab00477ed86064d911c06c75886bac96ad06147a3b3132191b81.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\DiskMan32.exeC:\Windows\DiskMan32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\llopjg.exeC:\Windows\llopjg.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\nlgokn.exeC:\Windows\nlgokn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\tymmoq.exeC:\Windows\tymmoq.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\tukavj.exeC:\Windows\tukavj.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\yiqqsu.exeC:\Windows\yiqqsu.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\ptkefn.exeC:\Windows\ptkefn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\vvfqyv.exeC:\Windows\vvfqyv.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\amwtfc.exeC:\Windows\amwtfc.exe1⤵
-
C:\Windows\aquhmv.exeC:\Windows\aquhmv.exe1⤵
-
C:\Windows\utysyg.exeC:\Windows\utysyg.exe1⤵
-
C:\Windows\agdruj.exeC:\Windows\agdruj.exe1⤵
-
C:\Windows\cuscal.exeC:\Windows\cuscal.exe1⤵
-
C:\Windows\futiak.exeC:\Windows\futiak.exe1⤵
-
C:\Windows\iewpdh.exeC:\Windows\iewpdh.exe1⤵
-
C:\Windows\wupkqv.exeC:\Windows\wupkqv.exe1⤵
-
C:\Windows\clgoxl.exeC:\Windows\clgoxl.exe1⤵
-
C:\Windows\hrmmto.exeC:\Windows\hrmmto.exe1⤵
-
C:\Windows\merdpz.exeC:\Windows\merdpz.exe1⤵
-
C:\Windows\ohvwac.exeC:\Windows\ohvwac.exe1⤵
-
C:\Windows\mubmwo.exeC:\Windows\mubmwo.exe1⤵
-
C:\Windows\piqgci.exeC:\Windows\piqgci.exe1⤵
-
C:\Windows\gmzrjo.exeC:\Windows\gmzrjo.exe1⤵
-
C:\Windows\wnwvbm.exeC:\Windows\wnwvbm.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DiskMan32.exe
DiskMan32.dll
memory/636-80-0x0000000010000000-0x000000001000B000-memory.dmp
memory/1460-118-0x0000000010000000-0x000000001000B000-memory.dmp
memory/1464-105-0x0000000010000000-0x000000001000B000-memory.dmp
memory/1612-171-0x0000000010000000-0x000000001000B000-memory.dmp
memory/1616-199-0x0000000010000000-0x000000001000B000-memory.dmp
memory/1668-227-0x0000000010000000-0x000000001000B000-memory.dmp
memory/2272-46-0x0000000010000000-0x000000001000B000-memory.dmp
memory/2772-144-0x0000000010000000-0x000000001000B000-memory.dmp
memory/2784-157-0x0000000010000000-0x000000001000B000-memory.dmp
memory/3268-122-0x0000000008EF0000-0x0000000008EF1000-memory.dmp
memory/3268-162-0x0000000009260000-0x0000000009261000-memory.dmp
memory/3268-281-0x000000000A450000-0x000000000A451000-memory.dmp
memory/3268-109-0x0000000008EB0000-0x0000000008EB1000-memory.dmp
memory/3268-84-0x0000000008B90000-0x0000000008B91000-memory.dmp
memory/3268-72-0x0000000008AE0000-0x0000000008AE1000-memory.dmp
memory/3268-273-0x0000000009BB0000-0x0000000009BB1000-memory.dmp
memory/3268-135-0x0000000009120000-0x0000000009121000-memory.dmp
memory/3268-232-0x0000000007A00000-0x0000000007A01000-memory.dmp
memory/3268-148-0x0000000001110000-0x0000000001111000-memory.dmp
memory/3268-60-0x0000000007A80000-0x0000000007A81000-memory.dmp
memory/3268-97-0x0000000007AB0000-0x0000000007AB1000-memory.dmp
memory/3268-62-0x0000000007AA0000-0x0000000007AA1000-memory.dmp
memory/3268-176-0x0000000003260000-0x0000000003261000-memory.dmp
memory/3268-262-0x0000000008CC0000-0x0000000008CC1000-memory.dmp
memory/3268-190-0x0000000001100000-0x0000000001101000-memory.dmp
memory/3268-289-0x0000000002E80000-0x0000000002E81000-memory.dmp
memory/3268-203-0x00000000032B0000-0x00000000032B1000-memory.dmp
memory/3268-247-0x0000000007A30000-0x0000000007A31000-memory.dmp
memory/3268-217-0x00000000079D0000-0x00000000079D1000-memory.dmp
memory/3268-2-0x0000000002F70000-0x0000000002F71000-memory.dmp
memory/3728-68-0x0000000010000000-0x000000001000B000-memory.dmp
memory/3764-242-0x0000000010000000-0x000000001000B000-memory.dmp
memory/3796-131-0x0000000010000000-0x000000001000B000-memory.dmp
memory/4208-185-0x0000000010000000-0x000000001000B000-memory.dmp
memory/4504-56-0x0000000010000000-0x000000001000B000-memory.dmp
memory/4916-257-0x0000000010000000-0x000000001000B000-memory.dmp
memory/5024-92-0x0000000010000000-0x000000001000B000-memory.dmp
memory/5028-213-0x0000000010000000-0x000000001000B000-memory.dmp
memory/5208-296-0x0000000010000000-0x000000001000B000-memory.dmp
memory/5244-269-0x0000000010000000-0x000000001000B000-memory.dmp
memory/5612-294-0x0000000010000000-0x000000001000B000-memory.dmp
memory/5912-295-0x0000000010000000-0x000000001000B000-memory.dmp