Overview

overview

7

Static

static

3

jaffacakes...nb.exe

windows10-2004-x64

7

jaffacakes...nb.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    12/10/2026, 19:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_Trojan-Downloader.Win32.NSIS.nb.exe
  • Size 1.4MB
  • Sample261012-x91b3set2t
  • SHA256 70744055971bfc9e06b36a0712669a747e538b6f4069bd7df54a3e3f8555cc03
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoveryexecutionspyware

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 7 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Program Files directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 54 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.NSIS.nb.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.NSIS.nb.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" http://taourl.com/6jb4v
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:984
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://taourl.com/6jb4v
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5028
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5028 CREDAT:17410 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:924
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" http://www.178gg.com/lianjie/10608.htm
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1676
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.178gg.com/lianjie/10608.htm
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4740
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4740 CREDAT:17410 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:556
    • C:\Windows\SysWOW64\Wscript.exe
      "C:\Windows\system32\Wscript" "C:\Program Files (x86)\soft100306\b_1006.vbs"
      2⤵
      • Executes a VBScript file via the Windows Script Host.
      • System Location Discovery: System Language Discovery
      PID:2792

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        jishu_100306.exe
        • Path C:\Program Files (x86)\jishu_100306\jishu_100306.exe
        • Size 1.0MB
        • SHA256 4369c213390dd318aaf57b841e338f0b781b16e61713c39e3d961d6065de1821
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jishu_100306.ini
        • Path C:\Program Files (x86)\jishu_100306\jishu_100306.ini
        • Size 7KB
        • SHA256 4c3284bb8f8d8b23f0a3630f67b7e89efac4a1feb073515d02716557c21fcefa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        b_1006.vbs
        • Path C:\Program Files (x86)\soft100306\b_1006.vbs
        • Size 226B
        • SHA256 ca13448aa384b48bd4aa33c7969668ee56a9d056b1b1fb677cb92e07a5c9affa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
        • Size 471B
        • SHA256 77f092574df221fef3caa5611bcc1a8c78381ec8c0c54bb107e6cc5355c4840f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
        • Size 416B
        • SHA256 43878e49142cdf4f7b633e6fd0dd7edb8d1c867f719c52f0ae837bc05b54b47e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        RecoveryStore.{DFA134E7-C673-11F1-A0CA-56B788D469C5}.dat
        • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{DFA134E7-C673-11F1-A0CA-56B788D469C5}.dat
        • Size 3KB
        • SHA256 00f7a101600c4c9c487c5f235a4dba33072786e2ae5e7a063ca8bdf42c4bfdff
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        RecoveryStore.{DFA85ADC-C673-11F1-A0CA-56B788D469C5}.dat
        • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{DFA85ADC-C673-11F1-A0CA-56B788D469C5}.dat
        • Size 5KB
        • SHA256 1f1098ce9c88a067788780cf2bd5f8ca307c4ebc83ebf64140123b4d64b6e718
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        suggestions[1].en-US
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U3DRQ2XJ\suggestions[1].en-US
        • Size 17KB
        • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FindProcDLL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsp1B40.tmp\FindProcDLL.dll
        • Size 31KB
        • SHA256 a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NSISdl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsp1B40.tmp\NSISdl.dll
        • Size 14KB
        • SHA256 fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download