35b48539cc075b1d2a47aa577860fa88c118098cf73ba47070e4d01c3e9c77e9

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 17:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Agent.neyndy.exe
Size 238KB
Sample261006-vwpmbasvgx
SHA256 35b48539cc075b1d2a47aa577860fa88c118098cf73ba47070e4d01c3e9c77e9
MD5 45f9a956e8fc0ae5b29f23265814f790
SHA1 32a27bf23d2184c15aff59d4729cdc606779b846
SHA512 c01ed19588670518e3a1bb79dfca0f95a116237f993e105ea3117ccfa4b3f88d86ebba0acb137b3c65454bd992e17ec09925f3beb58487038fccda9609ded191
SSDEEP 6144:5NHLr08qHmwvFBjcYifcueCccp5df3GhWEOPVy0ciPFV0:5NHP2HmwtKrcu5NdfxPh70
TLSH
T1183423ACEBD14E3EDBE789F438B1756EA217251BF29CD202012F798B48519A530DD60F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2276	mBXycrZSoLekYI5.exe
3252	CTS.exe
3640	CTS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	jaffacakes118_Trojan.Win32.Agent.neyndy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4176-0-0x0000000001000000-0x0000000001017000-memory.dmp	upx
behavioral2/files/0x001500000001c41c-8.dat	upx
behavioral2/memory/3252-11-0x0000000000C10000-0x0000000000C27000-memory.dmp	upx
behavioral2/memory/4176-10-0x0000000001000000-0x0000000001017000-memory.dmp	upx
behavioral2/files/0x0002000000019ca6-13.dat	upx
behavioral2/files/0x0005000000019f1c-28.dat	upx
behavioral2/memory/3640-33-0x0000000000C10000-0x0000000000C27000-memory.dmp	upx
behavioral2/memory/3252-34-0x0000000000C10000-0x0000000000C27000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\CTS.exe	CTS.exe
File created	C:\Windows\CTS.exe	jaffacakes118_Trojan.Win32.Agent.neyndy.exe
File created	C:\Windows\CTS.exe	CTS.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Agent.neyndy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mBXycrZSoLekYI5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CTS.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4176	jaffacakes118_Trojan.Win32.Agent.neyndy.exe
Token: SeDebugPrivilege	3252	CTS.exe
Token: SeDebugPrivilege	3640	CTS.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 2276	4176	jaffacakes118_Trojan.Win32.Agent.neyndy.exe	89
PID 4176 wrote to memory of 3252	4176	jaffacakes118_Trojan.Win32.Agent.neyndy.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.neyndy.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.neyndy.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Users\Admin\AppData\Local\Temp\mBXycrZSoLekYI5.exe
  C:\Users\Admin\AppData\Local\Temp\mBXycrZSoLekYI5.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2276
- C:\Windows\CTS.exe
  "C:\Windows\CTS.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3252

C:\Windows\CTS.exe
C:\Windows\CTS.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

officeclicktorun.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml
Size 512KB
SHA256 66b6b994f43d8ab27f7155c963d50d54a7772fa9cd6a0e584395b0f013132951
MD5 cfbe92c8f8bca354e7fcb31e0c3f11e1
SHA1 c8df088070926729d306295fd3329453e6851799
SHA512 8eb6f4947779bc3653c0a7a9d6a47db0cacc220fb07a339127f16c226a46dfae599e84672219d37f19794cb8d2b9676e991a1f9ad9507e4d38686b83a409ba77
SSDEEP 12288:5P2ZCMzD3nZc7vFQ7jMYH2MjupdXKHFC39c/DOtxh:5PadD3WJQMYWRLXA0MYT
TLSH
T163B423CDF66D4A79D0C380B537AA2F8B84533CABB954B00B1E6F5902A72D48E58C1777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mBXycrZSoLekYI5.exe

Path C:\Users\Admin\AppData\Local\Temp\mBXycrZSoLekYI5.exe
Size 238KB
SHA256 3c9cc747aa05ef9e512c10187941789c9eddd0d1095c732b743deeda934b3810
MD5 faedffc5f1c481678118645f431b9384
SHA1 77ecc7cc42b865bfcf935d4e686a3fb76c346cf4
SHA512 f1490069288453769e3f70b54290ce7bd7f0bf66f202fcb1d96e4a315ba7abdbe4401ea0408d2fb05716dfed07ca911e5a6ae3887379826f0cfafcaa281413cc
SSDEEP 6144:5W9wXYH1BwRimGTUHsQVN9jvGwfXCnvayE:5CwoYRiIVN9j+wfSFE
TLSH
T1B33423FCE5BFBF38CA4C71764FC39E8F24CC5807D35AD448992A27AE66682E87101519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mBXycrZSoLekYI5.exe

Path C:\Users\Admin\AppData\Local\Temp\mBXycrZSoLekYI5.exe
Size 212KB
SHA256 d00b782e71ca42ccb1f97b6d0d7c60dc33d2d535a90b9cc9a3ec9bcd1fd333c6
MD5 530c44b5c7e76315426435c7e61b13c2
SHA1 8d9a2284e4be9d6f13b0e1b69be736ad08038a79
SHA512 e0dea9a40ef4781a52c53c373cff31b0424646540fcd907375515a83f80e4cc7d2d6fd70a2cafdc947481ae5d43a923bc3a0310b85465ebba07e5de2af23e216
SSDEEP 6144:YubSpHwj9sY7dvEsnm6qTvdUVCRbXKC44cJFKI+f2nMe:zSQuY7dvEsnm6qTvdUVYKCVS5U2nMe
TLSH
T1B6245CA030808432D8531A7529F9C772AE3D39326B659FEBD3E48E785AB44D0F135A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CTS.exe

Path C:\Windows\CTS.exe
Size 26KB
SHA256 1955407b2fd523e375303d560b987216b95105b421a8471218c0b65ceba847f3
MD5 286211b8e0aad0533c45d8b8c351cc70
SHA1 cb54a305a566c00742fb972c4ee62266e880ea78
SHA512 91eddd484a40aee3a7a9254fd6843b3d9dd455e6a2c4d685d499ab1704d8644a6dc604ad14449e96b0754ae3e6c1c14c16d068605aa4e39840e0421aa7a4be35
SSDEEP 768:XkX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIo:6KcR4mjD9r82
TLSH
T1FEC2D06CFBDA0E39DBD5603E39EAA90E1515DA37119E434B153F7083FAE126C24C3624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3252-11-0x0000000000C10000-0x0000000000C27000-memory.dmp

Download

memory/3252-34-0x0000000000C10000-0x0000000000C27000-memory.dmp

Download

memory/3640-33-0x0000000000C10000-0x0000000000C27000-memory.dmp

Download

memory/4176-0-0x0000000001000000-0x0000000001017000-memory.dmp

Download

memory/4176-10-0x0000000001000000-0x0000000001017000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads