Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
18/10/2026, 19:08
General
- Target jaffacakes118_Trojan.Win32.Genome.ukmz.exe
- Size 3.2MB
- Sample261018-xtjpdshy41
- SHA256 2b5aec0667a79234f359b47ece4fbf50a4c0831946e1b8d08004c4efe2e7b17d
Malware Config
Signatures
- Executes dropped EXE 6 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 19 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Genome.ukmz.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Genome.ukmz.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AGENTRES.EXE"C:\Users\Admin\AppData\Local\Temp\AGENTRES.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-FBKUA.tmp\is-0PH6G.tmp"C:\Users\Admin\AppData\Local\Temp\is-FBKUA.tmp\is-0PH6G.tmp" /SL4 $9009C "C:\Users\Admin\AppData\Local\Temp\AGENTRES.EXE" 1590340 522243⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop NMEmployeesAgent4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop NMEmployeesAgent5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Network LookOut\Net Monitor for Employees Professional\bin\NLSAgentSvc.exe"C:\Program Files (x86)\Network LookOut\Net Monitor for Employees Professional\bin\NLSAgentSvc.exe" /SILENT /UNINSTALL4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Network LookOut\Net Monitor for Employees Professional\bin\NLSAgtConfig.exe"C:\Program Files (x86)\Network LookOut\Net Monitor for Employees Professional\bin\NLSAgtConfig.exe" INSTALL /encryption:Y4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CONSOLERES.EXE"C:\Users\Admin\AppData\Local\Temp\CONSOLERES.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-CS95N.tmp\is-NF3FO.tmp"C:\Users\Admin\AppData\Local\Temp\is-CS95N.tmp\is-NF3FO.tmp" /SL4 $601AE "C:\Users\Admin\AppData\Local\Temp\CONSOLERES.EXE" 2086779 522243⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
README_PRO.TXT
NLSAgentSvc.exe
NLSAgtConfig.exe
NLSupervisorPro.exe
NMEmployeesPro.hlp
advctrl.dll
is-L1FCD.tmp
ebuynow.url
eweb.url
unins000.exe
AGENTRES.EXE
CONSOLERES.EXE
_shfoldr.dll
is-NF3FO.tmp
memory/608-160-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/608-144-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/608-178-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/608-175-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/608-54-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/608-172-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/608-58-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/608-169-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/608-166-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/608-163-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/608-157-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/608-153-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/608-150-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/1100-26-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1100-147-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1100-50-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1100-30-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1716-136-0x0000000000400000-0x00000000004F7000-memory.dmp
memory/4244-48-0x0000000000400000-0x00000000008C6000-memory.dmp
memory/4244-1-0x00000000008C5000-0x00000000008C6000-memory.dmp
memory/4244-2-0x0000000000400000-0x00000000008C6000-memory.dmp
memory/4244-3-0x0000000000400000-0x00000000008C6000-memory.dmp
memory/4244-29-0x0000000000400000-0x00000000008C6000-memory.dmp
memory/4244-0-0x0000000000400000-0x00000000008C6000-memory.dmp
memory/4664-57-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/4664-43-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/4664-53-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/4664-146-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/4664-143-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/4816-158-0x0000000000400000-0x0000000000529000-memory.dmp
memory/4816-161-0x0000000000400000-0x0000000000529000-memory.dmp
memory/4816-179-0x0000000000400000-0x0000000000529000-memory.dmp
memory/4816-164-0x0000000000400000-0x0000000000529000-memory.dmp
memory/4816-148-0x0000000000400000-0x0000000000529000-memory.dmp
memory/4816-167-0x0000000000400000-0x0000000000529000-memory.dmp
memory/4816-176-0x0000000000400000-0x0000000000529000-memory.dmp
memory/4816-170-0x0000000000400000-0x0000000000529000-memory.dmp
memory/4816-151-0x0000000000400000-0x0000000000529000-memory.dmp
memory/4816-173-0x0000000000400000-0x0000000000529000-memory.dmp
memory/4816-154-0x0000000000400000-0x0000000000529000-memory.dmp
memory/6016-21-0x0000000000400000-0x0000000000413000-memory.dmp
memory/6016-19-0x0000000000400000-0x0000000000413000-memory.dmp
memory/6016-49-0x0000000000400000-0x0000000000413000-memory.dmp