531eb7a2eb0ac5d8a780667dffb88722741ce176f7a79d6a894d95d36a40eac5

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Clons.mvy.exe
Size 887KB
Sample261009-v98mcadb66
SHA256 531eb7a2eb0ac5d8a780667dffb88722741ce176f7a79d6a894d95d36a40eac5
MD5 b7ff12e6076db081bbe2b196c21f5e5a
SHA1 9fafe147ed41941de95864ce8042f860458e934a
SHA512 e64891b76aee7676f4b9062f109181b733a9f794d3d99f06e5453a1704235e6ff0bbd4aa8802fa471a5cac1d2db113efc19686599e861bb87be6f0b9db86b118
SSDEEP 12288:wctxpx6CRGdXldWJ6t/0jGLtPT7efQqTR2+Ynwo5f+Wpgp7XxhWfSLfe:w0jwec7s6tsj2riSxp9k7BER
TLSH
T1D5156D36F5C18837D1721E7CCD5BA7A86C2ABE106D28784B7BF80E4C4F3969139291D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3424	isass.exe
3168	isass.exe

Loads dropped DLL 4 IoCs

pid	Process
3424	isass.exe
3424	isass.exe
3168	isass.exe
3168	isass.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\isass = "\"C:\\Users\\Admin\\AppData\\Local\\isass.exe\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\isass = "\"C:\\Users\\Admin\\AppData\\Local\\isass.exe\""	reg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\run.bat	isass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2708	cmd.exe
5980	cmd.exe
4108	cmd.exe
256	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Clons.mvy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	isass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	isass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2016	reg.exe
236	reg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3424	isass.exe
3168	isass.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 3424	4896	jaffacakes118_Trojan-Dropper.Win32.Clons.mvy.exe	91
PID 3424 wrote to memory of 2708	3424	isass.exe	92
PID 2708 wrote to memory of 5980	2708	cmd.exe	94
PID 5980 wrote to memory of 2016	5980	cmd.exe	95
PID 3168 wrote to memory of 4108	3168	isass.exe	98
PID 4108 wrote to memory of 256	4108	cmd.exe	100
PID 256 wrote to memory of 236	256	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Clons.mvy.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Clons.mvy.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Users\Admin\AppData\Local\isass.exe
  "C:\Users\Admin\AppData\Local\isass.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V isass /D "\"C:\Users\Admin\AppData\Local\isass.exe\"" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5980
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V isass /D "\"C:\Users\Admin\AppData\Local\isass.exe\"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2016

C:\Users\Admin\AppData\Local\isass.exe
"C:\Users\Admin\AppData\Local\isass.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\run.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V isass /D "\"C:\Users\Admin\AppData\Local\isass.exe\"" /f
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:256
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V isass /D "\"C:\Users\Admin\AppData\Local\isass.exe\"" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

run.bat

Path C:\Users\Admin\AppData\Local\Temp\run.bat
Size 140B
SHA256 bb1bb3665554d8be1d83b6edfb7bd5758383e928d9ef8fec0fffd4f4afbb58dc
MD5 54f2de74b7312020f711d13f2d5d6408
SHA1 2ca605e84e0f226747bfb1759d4bec0b600d0489
SHA512 3d77c7a234a2fd800d47b3c13b9349f3160865565f16742cdaed6b04f4ecec684d6f4429b9efc161835c72573a06bd2724a4b39a4e12fd5a4c8d6e8703f74814
TLSH
T19AC02B05D0C8D046F460F40209BE0558CBBEC24E35012704C182913C071A5EDE0523C3
MD5 SHA1 SHA512 TLSH

Submit Download

isass.exe

Path C:\Users\Admin\AppData\Local\isass.exe
Size 149KB
SHA256 3867a224fd98e3ddaa02b47506c95dfbb0fbe4ce93783c5166e4888140bb28d7
MD5 cf4c1bf67ead14c5ef3e7938a1044ae3
SHA1 b813c700f0c542e93a1174eb76cbf80149bd73dc
SHA512 88a48c75fc19b13718900bb5f2cb3cfdbac5ae2d5fe175f8908794fc69eb60996ef1eb2e22b3b72d23563bfc27457c603d431901bfed833e7f8279e2e84f147f
SSDEEP 3072:joXVM4KReiSfZswwgs0lGOTdINKsVhaD6rpQcXbblYWChBu5ZlaYmM:YVkfnwwH0DE5f+WChwJ
TLSH
T1BEE36D23F1C18973D0721D78CE5AEAA96A2FFE202D7C184F75E80F4D4E392D1A459356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr.dll

Path C:\Users\Admin\AppData\Local\ntldr.dll
Size 149KB
SHA256 8160417e700ca87c75d7df7b8bda2a5086f447117cb1a9d3496f8265261d92b1
MD5 67d6fad76eb7d20d47c06e2342875c71
SHA1 dd9ceeb3e7f6c6fc1cff198c6c675ac0d6d260ec
SHA512 8cfcc9c016eeecd96fc78e8f32aab117f30d7ffc7fa8ccd0d1b33bd96c39b159423934b940bd874d5d0a9163da52a0d7ab7f21eb22b6f88a50cbd968dd5519a4
SSDEEP 3072:KRX4wvzTC527XLkymjaOA+qQqEJ0rPbSv9BzLXRR5YLfvBqQH:E4wHp7XLkFAhWfhR5YLfv
TLSH
T1C8E35E32F0C28C73D1761E789E5AA2A4682BFE207D7C344F75E90E4D4D3D6D2682D296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3168-39-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/3424-17-0x00000000021A0000-0x00000000021CA000-memory.dmp

Download

memory/3424-38-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/4896-0-0x0000000000489000-0x000000000048A000-memory.dmp

Download

memory/4896-1-0x0000000000400000-0x00000000004E5000-memory.dmp

Download

memory/4896-13-0x0000000000400000-0x00000000004E5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads