Overview

overview

7

Static

static

3

jaffacakes...ic.exe

windows10-2004-x64

7

jaffacakes...ic.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$SYSDIR/$_1_.exe

windows10-2004-x64

7

$SYSDIR/$_1_.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$_5_.dll

windows10-2004-x64

6

$_5_.dll

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/10/2026, 02:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  • Size 437KB
  • Sample261014-dcppjaex3w
  • SHA256 b027fdc658589d3f193d2a0896fd9c9c064a1f62ddeef9a90479b93c2cd8ecb9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoverypersistencespywarestealer

Malware Config

Signatures

  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 50 IoCs
    adwarespyware
  • Modifies registry class 10 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Installs/modifies Browser Helper Object
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer Protected Mode
    • Modifies Internet Explorer Protected Mode Banner
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\pmbegimvlcgikgydp.dll"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Installs/modifies Browser Helper Object
      • Maps connected drives based on registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:5108
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4952
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:228
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:228 CREDAT:17410 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3804

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
        • Size 471B
        • SHA256 94deecb8b3c9a16f48b404872478dc3c8c8aad2e5a5013615effcf6d732f7e8b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
        • Size 416B
        • SHA256 0e0f56641938a0955420212ab3f7ae2165e7ca00d6ceb98fa3ddc3b0b0c40069
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        suggestions[1].en-US
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EQ5O6WBF\suggestions[1].en-US
        • Size 17KB
        • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        favicon[1].ico
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LM36AMZP\favicon[1].ico
        • Size 4KB
        • SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsf1C3B.tmp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsf1C3B.tmp.dll
        • Size 731KB
        • SHA256 0c7f38a9380b65dd2f6cd641be934906736064369657d419d6edc96d7c79295e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsr1322.tmp\System.dll
        • Size 11KB
        • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4864-14-0x00000000022C0000-0x000000000237E000-memory.dmp
        Download

        memory/4864-27-0x00000000022C0000-0x000000000237E000-memory.dmp
        Download

        memory/5108-31-0x0000000002090000-0x000000000214E000-memory.dmp
        Download