Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 08:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Packed.Win32.NSAnti.r.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target jaffacakes118_Packed.Win32.NSAnti.r.exe
- Size 322KB
- Sample261014-klygcsfc87
- SHA256 a8a236127cfa625e81142c00effd186e6a28e3c3c8dd3ac79f20f289c3680b63
- MD5 ec1816938f7d942bef9f39113167c216
- SHA1 9805afc71853aa53e0f80749b39ca70f599232ed
- SHA512 4508844dcf2200194e0b727e4db080f22a1482961e7d50d525eafc1fa25459309f47f11ce8ab75b29712fefaa96b09d820ab52808cfd1338b40593f8f5e1016f
- SSDEEP 6144:npdCaTR2N84S+MJamK+6EzDVtEklZ+dr34EClxEUqwqS:zCI2N84mU+dVtJlZMzel2Uqwl
- TLSH T18664234E798D38ABC7AD45F9F38B591DFAF03C8EB468CB63657806933C22C636291154
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1140 M_Server2006.exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\Favorites IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\Favorites\desktop.ini IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Low IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\IECompatCache\Low IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\Low IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\TabRoaming IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Virtualized IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE\Low IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\DNTException\Low IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\IECompatUaCache\Low IEXPLORE.EXE - Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\uninstal.bat jaffacakes118_Packed.Win32.NSAnti.r.exe File opened for modification C:\Windows\SystemTemp\Low IEXPLORE.EXE File created C:\Windows\M_Server2006.exe jaffacakes118_Packed.Win32.NSAnti.r.exe File opened for modification C:\Windows\M_Server2006.exe jaffacakes118_Packed.Win32.NSAnti.r.exe File created C:\Windows\M_Server2006.DLL M_Server2006.exe File opened for modification C:\Windows\M_Server2006.DLL M_Server2006.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2556 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Packed.Win32.NSAnti.r.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language M_Server2006.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Connection Wizard M_Server2006.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main M_Server2006.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft msedge.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1335280846" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\F12 IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Zones IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge msedge.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no" M_Server2006.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\OperationalData = "12" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation\UnattendLoaded = "1" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Feeds IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe = "1" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\ElfBeacon msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\RepService IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\BLBeacon msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge\ElfBeacon\version = "139.0.3405.125" msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Passport\LowDAMap IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport\LowDAMap IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\OperationalData = "8" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Connection Wizard\Completed = 01000000 M_Server2006.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry IEXPLORE.EXE - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1140 wrote to memory of 4240 1140 M_Server2006.exe 91 PID 2948 wrote to memory of 2556 2948 jaffacakes118_Packed.Win32.NSAnti.r.exe 92 PID 4240 wrote to memory of 4608 4240 IEXPLORE.EXE 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Packed.Win32.NSAnti.r.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Packed.Win32.NSAnti.r.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2556
-
-
C:\Windows\M_Server2006.exeC:\Windows\M_Server2006.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" about:blank2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "about:blank"3⤵
- Modifies data under HKEY_USERS
PID:4608
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\M_Server2006.exe
- Size 322KB
- SHA256 a8a236127cfa625e81142c00effd186e6a28e3c3c8dd3ac79f20f289c3680b63
- MD5 ec1816938f7d942bef9f39113167c216
- SHA1 9805afc71853aa53e0f80749b39ca70f599232ed
- SHA512 4508844dcf2200194e0b727e4db080f22a1482961e7d50d525eafc1fa25459309f47f11ce8ab75b29712fefaa96b09d820ab52808cfd1338b40593f8f5e1016f
- SSDEEP 6144:npdCaTR2N84S+MJamK+6EzDVtEklZ+dr34EClxEUqwqS:zCI2N84mU+dVtJlZMzel2Uqwl
- TLSH T18664234E798D38ABC7AD45F9F38B591DFAF03C8EB468CB63657806933C22C636291154
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\config\systemprofile\Favorites\desktop.ini
- Size 402B
- SHA256 a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464
- MD5 881dfac93652edb0a8228029ba92d0f5
- SHA1 5b317253a63fecb167bf07befa05c5ed09c4ccea
- SHA512 592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810
- TLSH T113E06D04A2F9261012319E22BC78D001CBB1B8212C1BCE8E8680918A18D0A18EA33B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\uninstal.bat
- Size 196B
- SHA256 42cdcbfb7beb8d9c14ea9bf81f1c25c9e176d8d721610b0035aa42483f4700fa
- MD5 fd50c6e7b37bda5c5b469c2b5eb94674
- SHA1 b4454fdd7b190db9f89264a00aae231953797bea
- SHA512 eeceb3f29e3ad0534f4ad06db18439655d6c978e1d7de23213a7f93f05f7871096d0ec7f8aa8f0e8ceeb117a6c34aba28e122096622fc21cd2b784400195fbe5
- TLSH T12ED0C94181B6C5AA0814D81F4638668EC05619A937893B290623C1C955B2129F7D2F49
- MD5 SHA1 SHA512 TLSH