Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
14/10/2026, 04:48
General
- Target jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Wajam.gen.exe
- Size 226KB
- Sample261014-ffdsjsfx91
- SHA256 4c66397111ccf4e1e20678941f3df997e84c556c891332006155d4799dd2b1a4
Malware Config
Signatures
- Loads dropped DLL 31 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Wajam.gen.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Wajam.gen.exe"1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C Systeminfo | findstr /i model2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\systeminfo.exeSysteminfo3⤵
- System Location Discovery: System Language Discovery
- Gathers system information
-
-
C:\Windows\SysWOW64\findstr.exefindstr /i model3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
GetVersion.dll
Math.dll
System.dll
UserInfo.dll
blowfish.dll
manlib.dll
nsDialogs.dll
nsExec.dll
registry.dll
memory/5040-27-0x0000000004960000-0x000000000497A000-memory.dmp
memory/5040-19-0x0000000004900000-0x0000000004959000-memory.dmp