Overview
overview
7Static
static
3jaffacakes...en.exe
windows10-2004-x64
7jaffacakes...en.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows11-ltsc_2024-x64
37za.exe
windows10-2004-x64
37za.exe
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 03:58
Behavioral task
behavioral1
Sample
jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.BrowseFox.gen.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.BrowseFox.gen.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/inetc.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
7za.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
7za.exe
Resource
win11ltsc2024-20260911-en
General
- Target jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.BrowseFox.gen.exe
- Size 291KB
- Sample261014-ejvpssfy7j
- SHA256 affe4820a579343b655f16590d5941af3f4e37e37de1b69a283cbfdc897e91bd
- MD5 e1c1647e2a46cfd9190abde0e66f29f3
- SHA1 fa7b6eb75dc7881674278340635d0ed1f7f50bcd
- SHA512 10fc48040bd7df2b8012d7e9d8e40f1e1c53554a32b9bd7f4d34262f7c2244edb22a904ed12cbe6f5b19615d3a95abaf541e5e8517bcbe4da30271050420f3a3
- SSDEEP 6144:a4LFHsN18PdACJ7bm/Aa02vn8Jo2pBpvf+wy4FqYHq0ITUBbQ:7pHyuPKCJ7iz02v8fpHLqG3qUdQ
- TLSH T13554128B2DC16057D6A3CA74CAE7C6A7D9B2A3845033476B5F708F722E21152CB616F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
pid Process 3060 jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.BrowseFox.gen.exe 3060 jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.BrowseFox.gen.exe 3060 jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.BrowseFox.gen.exe 3060 jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.BrowseFox.gen.exe 3060 jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.BrowseFox.gen.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.BrowseFox.gen.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.BrowseFox.gen.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.BrowseFox.gen.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.BrowseFox.gen.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.BrowseFox.gen.exe"1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3060
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsu8E3E.tmp\System.dll
- Size 10KB
- SHA256 9bb31f7f02231e3166bf52385d804c06da9740e9c6f0bda807b01052ae9fdcd4
- MD5 7fbda5b7be6256996d4e59e5f6949918
- SHA1 2d36c0e0bfbe450675c6ed044e715abaa85a252a
- SHA512 bc0d36aa6f50041bad05cf48d909ed5a387bff5b111f657591161a288c1be5c20b8c5d69e557b5ea395726d91601b9e6303da81555e053090cfcbf5d44be7f82
- SSDEEP 192:cR9jFtTLkreShqlyXMUspRRFtvD4feuy9mt2h8pGfhn9:crjy+2MFmfeuyaG5n9
- TLSH T109224C65439082F3D894823C1D627A371B7D362091F34E93EFB358D4DD6AA427E3A356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu8E3E.tmp\inetc.dll
- Size 20KB
- SHA256 3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420
- MD5 e541458cfe66ef95ffbea40eaaa07289
- SHA1 caec1233f841ee72004231a3027b13cdeb13274c
- SHA512 0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c
- SSDEEP 384:b1JO6XgZkjxm+NpXaWgzxUX//EUhU7ya4LQ0Ac9khYLMkIX0+GBty3Sm0:b+6Xgsm+NpKWgzxUXnEUhUua4Li70
- TLSH T1C1921A01AF5566F3D3A90830F569375686EBAE742530A4876BF31FCD186A283FA35703
- MD5 SHA1 SHA512 SSDEEP TLSH