Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
15/10/2026, 23:05
General
- Target jaffacakes118_Trojan.Win32.Agent.neydet.exe
- Size 11KB
- Sample261015-222bmattfv
- SHA256 62645a80d1d5e04c464bf14f96de9307aab284d0e89da95a8d08bc4ec825100b
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.neydet.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.neydet.exe"1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3240-1-0x0000020D32C60000-0x0000020D32C68000-memory.dmp
memory/3240-0-0x00007FFA319FF000-0x00007FFA31A00000-memory.dmp
memory/3240-2-0x00007FFA31870000-0x00007FFA32214000-memory.dmp
memory/3240-3-0x00007FFA31870000-0x00007FFA32214000-memory.dmp
memory/3240-4-0x00007FFA31870000-0x00007FFA32214000-memory.dmp
memory/3240-5-0x00007FFA31870000-0x00007FFA32214000-memory.dmp
memory/3240-6-0x00007FFA31870000-0x00007FFA32214000-memory.dmp
memory/3240-7-0x00007FFA31870000-0x00007FFA32214000-memory.dmp
memory/3240-8-0x00007FFA31870000-0x00007FFA32214000-memory.dmp
memory/3240-9-0x00007FFA31870000-0x00007FFA32214000-memory.dmp