250423e134949640c251afaf1d532e6544965c88ed0b96a06583ddba37cf5f87

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 20:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Sysn.brvy.exe
Size 58KB
Sample261009-y72mssec37
SHA256 250423e134949640c251afaf1d532e6544965c88ed0b96a06583ddba37cf5f87
MD5 544adfd4da79c88ff23b87862f4c76e5
SHA1 dde7a30ef0db437300a0cd0dbcd603066d71cd2d
SHA512 2fa62e4f12b2a49e35c995b7d18bf1863b6c22e0ffec317f02d4303c3cfb0f70a4602fc58ba058818da1f59fd54c75094ce20542edb1c8e8870d7855d3b9e166
SSDEEP 1536:oDc/zaiSE1FgWGgxgz37Wq89zKWKnGHtRR:L+iSE2yq89zSnGH5
TLSH
T115436D0E7BC85A12DDBEAF712D76C5222674DA034153DB9F4ECC98DA6F3239185007EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 14 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1184	netsh.exe
4876	netsh.exe
1764	netsh.exe
3088	netsh.exe
3784	netsh.exe
4260	netsh.exe
3652	netsh.exe
980	netsh.exe
4464	netsh.exe
916	netsh.exe
844	netsh.exe
4604	netsh.exe
3456	netsh.exe
1656	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	Winds.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	Winds.exe

Executes dropped EXE 2 IoCs

pid	Process
652	Winds.exe
3372	Winds.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Winds.exe"	Winds.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
3708	WScript.exe
1584	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 42 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Winds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Winds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Winds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Winds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	Winds.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	Winds.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 652	2696	jaffacakes118_Trojan-Dropper.Win32.Sysn.brvy.exe	86
PID 652 wrote to memory of 1184	652	Winds.exe	90
PID 652 wrote to memory of 3708	652	Winds.exe	92
PID 3372 wrote to memory of 980	3372	Winds.exe	99
PID 3372 wrote to memory of 1584	3372	Winds.exe	101
PID 652 wrote to memory of 4464	652	Winds.exe	107
PID 3372 wrote to memory of 916	3372	Winds.exe	109
PID 652 wrote to memory of 844	652	Winds.exe	117
PID 3372 wrote to memory of 4876	3372	Winds.exe	119
PID 652 wrote to memory of 1764	652	Winds.exe	121
PID 3372 wrote to memory of 3088	3372	Winds.exe	123
PID 652 wrote to memory of 3784	652	Winds.exe	127
PID 3372 wrote to memory of 4260	3372	Winds.exe	129
PID 652 wrote to memory of 4604	652	Winds.exe	131
PID 3372 wrote to memory of 3456	3372	Winds.exe	133
PID 652 wrote to memory of 3652	652	Winds.exe	136
PID 3372 wrote to memory of 1656	3372	Winds.exe	138

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Sysn.brvy.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Sysn.brvy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Temp\Winds.exe
  C:\Users\Admin\AppData\Local\Temp\Winds.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1184
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\r.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    PID:3708
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4464
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:844
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1764
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3784
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4604
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3652

C:\Users\Admin\AppData\Local\Temp\Winds.exe
C:\Users\Admin\AppData\Local\Temp\Winds.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:980
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\r.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:1584
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:916
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4876
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3088
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4260
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3456
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Winds.exe

Path C:\Users\Admin\AppData\Local\Temp\Winds.exe
Size 58KB
SHA256 250423e134949640c251afaf1d532e6544965c88ed0b96a06583ddba37cf5f87
MD5 544adfd4da79c88ff23b87862f4c76e5
SHA1 dde7a30ef0db437300a0cd0dbcd603066d71cd2d
SHA512 2fa62e4f12b2a49e35c995b7d18bf1863b6c22e0ffec317f02d4303c3cfb0f70a4602fc58ba058818da1f59fd54c75094ce20542edb1c8e8870d7855d3b9e166
SSDEEP 1536:oDc/zaiSE1FgWGgxgz37Wq89zKWKnGHtRR:L+iSE2yq89zSnGH5
TLSH
T115436D0E7BC85A12DDBEAF712D76C5222674DA034153DB9F4ECC98DA6F3239185007EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r.vbs

Path C:\Users\Admin\AppData\Local\Temp\r.vbs
Size 340B
SHA256 19df86d358fa99fb0bb5f16b29c725d1230df5b268fdaee2771ac108cca629c4
MD5 f4b6b6633506b2a126b76a87469973f0
SHA1 b7366587ff9a2c9ef34b2343b33761e85457195d
SHA512 41c088559f878c76feb9abd6ca68ee8dcb81310fd663955df5b148d756d364529acabc4cdb145111586aa27065d6267b913d5782c662512c031f08c0e7e6e2da
TLSH
T18CE026156D5DE66C9158EB72A120BC1F8FF114543A3238B54E3CC987BE280A849D482F
MD5 SHA1 SHA512 TLSH

Submit Download

r.vbs

Path C:\Users\Admin\AppData\Local\Temp\r.vbs
Size 341B
SHA256 9accf5189c247c123b77d9e442c89c8ad4dfebfdb2ff33e7b4e96488a7899b36
MD5 99b2f7f353013df3a5a8a5080d372448
SHA1 2b143e32f699859114c262f83f0b98b774feb87c
SHA512 341a4434cbcf7af8c0a283ffad84548fbfe4c413dd6e9f54160ee2dd113ef862310c806715d2159fa8af45ffc855da41b751337c70bf46753a9f154bf3cd7f42
TLSH
T123E026156D9DD26C9158EB72A120BC1F9FF114A47A3138B54E3CCDC7BE280A889D482F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/652-41-0x00007FFF84C80000-0x00007FFF85621000-memory.dmp

Download

memory/652-40-0x00007FFF84C80000-0x00007FFF85621000-memory.dmp

Download

memory/652-26-0x00007FFF84C80000-0x00007FFF85621000-memory.dmp

Download

memory/652-22-0x00007FFF84C80000-0x00007FFF85621000-memory.dmp

Download

memory/652-21-0x00007FFF84C80000-0x00007FFF85621000-memory.dmp

Download

memory/652-20-0x00007FFF84C80000-0x00007FFF85621000-memory.dmp

Download

memory/652-19-0x00007FFF84C80000-0x00007FFF85621000-memory.dmp

Download

memory/652-18-0x00007FFF84C80000-0x00007FFF85621000-memory.dmp

Download

memory/2696-6-0x00007FFF84C80000-0x00007FFF85621000-memory.dmp

Download

memory/2696-0-0x00007FFF84F35000-0x00007FFF84F36000-memory.dmp

Download

memory/2696-17-0x00007FFF84C80000-0x00007FFF85621000-memory.dmp

Download

memory/2696-10-0x00007FFF84C80000-0x00007FFF85621000-memory.dmp

Download

memory/2696-9-0x00007FFF84C80000-0x00007FFF85621000-memory.dmp

Download

memory/2696-8-0x00007FFF84C80000-0x00007FFF85621000-memory.dmp

Download

memory/2696-7-0x00007FFF84C80000-0x00007FFF85621000-memory.dmp

Download

memory/2696-11-0x00007FFF84C80000-0x00007FFF85621000-memory.dmp

Download

memory/2696-24-0x00007FFF84C80000-0x00007FFF85621000-memory.dmp

Download

memory/2696-25-0x00007FFF84C80000-0x00007FFF85621000-memory.dmp

Download

memory/2696-5-0x00000000010D0000-0x00000000010D8000-memory.dmp

Download

memory/2696-4-0x000000001C4D0000-0x000000001C576000-memory.dmp

Download

memory/2696-3-0x000000001B880000-0x000000001B91C000-memory.dmp

Download

memory/2696-2-0x00007FFF84C80000-0x00007FFF85621000-memory.dmp

Download

memory/2696-1-0x000000001BE50000-0x000000001C31E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads