Overview

overview

7

Static

static

3

jaffacakes...ic.exe

windows10-2004-x64

7

jaffacakes...ic.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/10/2026, 04:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe
  • Size 313KB
  • Sample261014-elhs1sed48
  • SHA256 122a4e5b6153e899b5703bc43464175a0f01d4d972db1ef1bac9d2ab79a4ac3b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryinstallerspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 2 IoCs
    installer
  • Modifies registry class 63 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Users\Admin\AppData\Local\Temp\7zSF160.tmp\setup.exe
      .\setup.exe /s
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • System policy modification
      PID:4808

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        chrome.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF160.tmp\[email protected]\chrome.manifest
        • Size 114B
        • SHA256 4ae2a91d24c3180efea2fbbdef51eefed21259984c527830b8a2015fe3a17aa5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        indexeddb.js
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF160.tmp\[email protected]\content\indexeddb.js
        • Size 1KB
        • SHA256 35a5452b400276c67ac05e6ef456fc38b71f0c4960c970646440695d279f74e4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        jquery.js
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF160.tmp\[email protected]\content\jquery.js
        • Size 91KB
        • SHA256 3739b485ac39b157caa066b883e4d9d3f74c50beff0b86cd8a24ce407b179a23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsext.js
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF160.tmp\[email protected]\content\jsext.js
        • Size 6KB
        • SHA256 30825036effbe79c580475dc071c1597e0dc9e247405b8ddf9ae93f3b3e76dc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lsdb.js
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF160.tmp\[email protected]\content\lsdb.js
        • Size 1KB
        • SHA256 5d742f8b73a2c11e0b790f0f1ead7bf0d72ad8392b2a22c36c745ca79ccac5bb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        prfdb.js
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF160.tmp\[email protected]\content\prfdb.js
        • Size 1KB
        • SHA256 268dce3cb4007ba5909e0116c996b04bfe26fb20e7383d5a18a3465d7cc37e96
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sqlite.js
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF160.tmp\[email protected]\content\sqlite.js
        • Size 1KB
        • SHA256 5acc4d0a6069967ad78ad2850f5ce6a9ca7f96d5397d2ed613b93176da9ebe87
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wx.xul
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF160.tmp\[email protected]\content\wx.xul
        • Size 228B
        • SHA256 e583de930989ef50e4a7e7b763f6f233b4b9c022b1c74b6698d81bde59d9e6d9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        install.rdf
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF160.tmp\[email protected]\install.rdf
        • Size 677B
        • SHA256 3ec492f78cb28bbf83601d1424512582229902ddd21a4e5ef607ab064c99d15e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        background.html
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF160.tmp\background.html
        • Size 5KB
        • SHA256 83a2aae5c77b712deb4a7ab0fc101e4295bde298e7df1b94258f7f963acc4c7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bhoclass.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF160.tmp\bhoclass.dll
        • Size 137KB
        • SHA256 7bf09b5c2a9b6348227199c1b3951b57907ca6a5c215a04ad8d5e43232f5b562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        blpbnjddjkhgjpihcochoifailillhmc.crx
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF160.tmp\blpbnjddjkhgjpihcochoifailillhmc.crx
        • Size 37KB
        • SHA256 c4ce62c01a8d3b3b6489827f8fa6a87befb93d7371ff8734052d66e5b1ffd7c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        content.js
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF160.tmp\content.js
        • Size 385B
        • SHA256 750b3b81c055af9d94fba223a76bffdd43d855939740edebbfe87d7b1ad0c17f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        settings.ini
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF160.tmp\settings.ini
        • Size 599B
        • SHA256 71dcaae9ed73165e5c1d011f26fef14ce5eadc5267a992b2519eb80d8f96e5f5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        setup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7zSF160.tmp\setup.exe
        • Size 61KB
        • SHA256 15c0e4fd6091cda70fa308ea5ee956996f6eb23d24e44700bd5c74bf111cf2aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download