250423e134949640c251afaf1d532e6544965c88ed0b96a06583ddba37cf5f87

Analysis

max time kernel
103s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 20:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Sysn.brvy.exe
Size 58KB
Sample261009-y72mssec37
SHA256 250423e134949640c251afaf1d532e6544965c88ed0b96a06583ddba37cf5f87
MD5 544adfd4da79c88ff23b87862f4c76e5
SHA1 dde7a30ef0db437300a0cd0dbcd603066d71cd2d
SHA512 2fa62e4f12b2a49e35c995b7d18bf1863b6c22e0ffec317f02d4303c3cfb0f70a4602fc58ba058818da1f59fd54c75094ce20542edb1c8e8870d7855d3b9e166
SSDEEP 1536:oDc/zaiSE1FgWGgxgz37Wq89zKWKnGHtRR:L+iSE2yq89zSnGH5
TLSH
T115436D0E7BC85A12DDBEAF712D76C5222674DA034153DB9F4ECC98DA6F3239185007EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 14 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
120	netsh.exe
3164	netsh.exe
1136	netsh.exe
2452	netsh.exe
3936	netsh.exe
4928	netsh.exe
5688	netsh.exe
3120	netsh.exe
2592	netsh.exe
2324	netsh.exe
3436	netsh.exe
2408	netsh.exe
3328	netsh.exe
5964	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
4748	Winds.exe
3856	Winds.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Winds.exe"	Winds.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
1424	WScript.exe
952	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Winds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Winds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Winds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Winds.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	Winds.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	Winds.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 4748	4312	jaffacakes118_Trojan-Dropper.Win32.Sysn.brvy.exe	88
PID 4748 wrote to memory of 120	4748	Winds.exe	89
PID 4748 wrote to memory of 1424	4748	Winds.exe	91
PID 3856 wrote to memory of 2592	3856	Winds.exe	96
PID 3856 wrote to memory of 952	3856	Winds.exe	98
PID 4748 wrote to memory of 2324	4748	Winds.exe	100
PID 3856 wrote to memory of 3436	3856	Winds.exe	102
PID 4748 wrote to memory of 2408	4748	Winds.exe	104
PID 3856 wrote to memory of 3164	3856	Winds.exe	106
PID 4748 wrote to memory of 3328	4748	Winds.exe	108
PID 3856 wrote to memory of 1136	3856	Winds.exe	110

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Sysn.brvy.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Sysn.brvy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Users\Admin\AppData\Local\Temp\Winds.exe
  C:\Users\Admin\AppData\Local\Temp\Winds.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:120
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\r.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    PID:1424
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2324
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2408
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3328
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    PID:5964
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    PID:3936
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" firewall set opmode disable
    3⤵
    - Modifies Windows Firewall
    PID:5688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3864

C:\Users\Admin\AppData\Local\Temp\Winds.exe
C:\Users\Admin\AppData\Local\Temp\Winds.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2592
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\r.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:952
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3436
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3164
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1136
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  PID:2452
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  PID:4928
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  PID:3120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Winds.exe

Path C:\Users\Admin\AppData\Local\Temp\Winds.exe
Size 58KB
SHA256 250423e134949640c251afaf1d532e6544965c88ed0b96a06583ddba37cf5f87
MD5 544adfd4da79c88ff23b87862f4c76e5
SHA1 dde7a30ef0db437300a0cd0dbcd603066d71cd2d
SHA512 2fa62e4f12b2a49e35c995b7d18bf1863b6c22e0ffec317f02d4303c3cfb0f70a4602fc58ba058818da1f59fd54c75094ce20542edb1c8e8870d7855d3b9e166
SSDEEP 1536:oDc/zaiSE1FgWGgxgz37Wq89zKWKnGHtRR:L+iSE2yq89zSnGH5
TLSH
T115436D0E7BC85A12DDBEAF712D76C5222674DA034153DB9F4ECC98DA6F3239185007EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r.vbs

Path C:\Users\Admin\AppData\Local\Temp\r.vbs
Size 341B
SHA256 f1c9c3dd3774a893b20f36e8853dd9e886cc6d375b3bb2a284b917d6ba0ca1fd
MD5 c5768c80709e2dea026dab8e44ee7953
SHA1 a5c77813c5c2e842c01444f1ab87eff79a8e4782
SHA512 35d636ed77a6fe71f7f3ffbbe42a79ced6f8176c808024e0788bf60e211352b1f20cf2403dfd1042487ad847328c51a6c0e73a810d77c2080ec7f69ddf2bead3
TLSH
T1ACE026196E5DD66CD158EB72A120BD5F8FF214543A3138B50E3DC887BE2C0A849D482F
MD5 SHA1 SHA512 TLSH

Submit Download

r.vbs

Path C:\Users\Admin\AppData\Local\Temp\r.vbs
Size 341B
SHA256 814a9552888eab9e3e8f53408b0f44f6b8ea291a9ec238f529e06b889969e14e
MD5 be42a506c17f5941cece3570bff7388b
SHA1 e4df84a724295b367933a240c6ef72f0922e8e46
SHA512 2eb16edd304db634d80ee19d8b0e36ee97e4750ae927e9a2161ac747c1ba08070e11b80364b03feb7a4e3558bf6e206822a0d1d73a524309d920a0b9b9ae0b47
TLSH
T1A6E026196D5DE26C9168EB72A120BC1F8FF114543A3179B50E3CC887BE380A849D482F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4312-9-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4312-12-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4312-5-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4312-6-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4312-7-0x00000000031B0000-0x00000000031B8000-memory.dmp

Download

memory/4312-8-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4312-0-0x00007FF832B3A000-0x00007FF832B3B000-memory.dmp

Download

memory/4312-10-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4312-11-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4312-31-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4312-1-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4312-15-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4312-14-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4312-16-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4312-17-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4312-3-0x000000001C890000-0x000000001C92C000-memory.dmp

Download

memory/4312-4-0x000000001CAE0000-0x000000001CB86000-memory.dmp

Download

memory/4312-2-0x000000001C320000-0x000000001C7EE000-memory.dmp

Download

memory/4312-13-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4748-20-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4748-22-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4748-24-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4748-25-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4748-26-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4748-27-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4748-28-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4748-30-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4748-29-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4748-23-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4748-32-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4748-19-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4748-21-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4748-48-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

memory/4748-49-0x00007FF832840000-0x00007FF833278000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads