Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 03:45
General
- Target jaffacakes118_not-a-virus.Downloader.Win32.Bundl.aqv.exe
- Size 3.4MB
- Sample261014-ebhp9sfs2v
- SHA256 7f6b21e4e256a5cee9df1d7392935a90a4025fd10bbd939dd1123e5f7b7edd68
Malware Config
Signatures
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 31 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 11 IoCs
Inno Setup installer
- Kills process with taskkill 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Bundl.aqv.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Bundl.aqv.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-R297F.tmp\jaffacakes118_not-a-virus.Downloader.Win32.Bundl.aqv.tmp"C:\Users\Admin\AppData\Local\Temp\is-R297F.tmp\jaffacakes118_not-a-virus.Downloader.Win32.Bundl.aqv.tmp" /SL5="$60170,3259595,55296,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Bundl.aqv.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Win Panel\WinPanel.exe"C:\Program Files (x86)\Win Panel\WinPanel.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Win Panel\FreeGamiaGamePlayerSetup.exe"C:\Program Files (x86)\Win Panel\FreeGamiaGamePlayerSetup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-MRVF4.tmp\FreeGamiaGamePlayerSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-MRVF4.tmp\FreeGamiaGamePlayerSetup.tmp" /SL5="$3029A,1205776,55296,C:\Program Files (x86)\Win Panel\FreeGamiaGamePlayerSetup.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\FreeGamia Game Player\FreeGamiaGamePlayer.exe"C:\Program Files (x86)\FreeGamia Game Player\FreeGamiaGamePlayer.exe"5⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Program Files (x86)\Win Panel\FalcoBrowserSetup.exe"C:\Program Files (x86)\Win Panel\FalcoBrowserSetup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-7F4JA.tmp\FalcoBrowserSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-7F4JA.tmp\FalcoBrowserSetup.tmp" /SL5="$401C4,1420936,55296,C:\Program Files (x86)\Win Panel\FalcoBrowserSetup.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Falco Browser\Falco Browser.exe"C:\Program Files (x86)\Falco Browser\Falco Browser.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c taskkill /f /im rkverify.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im rkverify.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
EnglishEN.dll
Falco Browser.exe
Falco.url
FreeGamiaGamePlayer.exe
is-D1ACG.tmp
FreeGamia.url
FalcoBrowserSetup.exe
FreeGamiaGamePlayerSetup.exe
WinPanel.exe
itdownload.dll
FreeGamiaGamePlayerSetup.tmp
jaffacakes118_not-a-virus.Downloader.Win32.Bundl.aqv.tmp
_shfoldr.dll
memory/944-30-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/944-22-0x0000000002370000-0x0000000002371000-memory.dmp
memory/944-84-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/944-16-0x0000000005F10000-0x0000000005F4C000-memory.dmp
memory/944-21-0x0000000005F10000-0x0000000005F4C000-memory.dmp
memory/944-27-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/944-20-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/944-7-0x0000000002370000-0x0000000002371000-memory.dmp
memory/944-24-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/1112-114-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/1112-148-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/1112-158-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/1112-110-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/1112-106-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/1452-147-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/1452-104-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/1452-113-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/1452-162-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/1452-109-0x0000000000400000-0x00000000004BC000-memory.dmp
memory/2976-81-0x0000000000810000-0x0000000000826000-memory.dmp
memory/2976-83-0x0000000005A20000-0x0000000005FDA000-memory.dmp
memory/2976-82-0x00000000053C0000-0x000000000545C000-memory.dmp
memory/2976-74-0x00000000727E2000-0x00000000727E3000-memory.dmp
memory/2976-91-0x0000000005560000-0x00000000055B6000-memory.dmp
memory/2976-90-0x0000000005360000-0x000000000536A000-memory.dmp
memory/2976-105-0x00000000727E2000-0x00000000727E3000-memory.dmp
memory/2976-85-0x0000000005460000-0x00000000054F2000-memory.dmp
memory/3176-180-0x0000000000400000-0x00000000007B4000-memory.dmp
memory/3176-181-0x0000000000400000-0x00000000007B4000-memory.dmp
memory/3176-182-0x0000000000400000-0x00000000007B4000-memory.dmp
memory/4128-102-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4128-66-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4128-164-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4508-103-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4508-76-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4508-161-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5736-89-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5736-19-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5736-0-0x0000000000400000-0x0000000000414000-memory.dmp