Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
12/10/2026, 21:30
General
- Target jaffacakes118_Virus.Win32.Virut.ce.exe
- Size 119KB
- Sample261012-1csshsa16n
- SHA256 333edfd4d8f48a7b8cebffa0dc5c847af20403af3a3c3f99a65f5f7423a1e848
Malware Config
Signatures
- Modifies firewall policy service 3 TTPs 4 IoCs
- Drops file in Drivers directory 1 IoCs
- Loads dropped DLL 1 IoCs
- Drops file in System32 directory 1 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 64 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Virut.ce.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Virut.ce.exe"1⤵
- Modifies firewall policy service
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 6002⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2948 -ip 29481⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Process Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
netsh.exe
memory/2948-0-0x0000000001800000-0x0000000001826000-memory.dmp
memory/2948-3-0x0000000077593000-0x0000000077594000-memory.dmp
memory/2948-2-0x0000000077592000-0x0000000077593000-memory.dmp
memory/2948-1-0x000000007FE40000-0x000000007FE4C000-memory.dmp
memory/2948-5-0x000000007FE40000-0x000000007FE4C000-memory.dmp
memory/2948-6-0x000000007FE40000-0x000000007FE4C000-memory.dmp
memory/2948-8-0x0000000000690000-0x00000000006B6000-memory.dmp
memory/2948-9-0x000000007FE40000-0x000000007FE4C000-memory.dmp
memory/2948-12-0x0000000001800000-0x0000000001826000-memory.dmp