740f6afcbfc829264bacd9410c243834455bb8b4ae35bb02595a82ccd7b51fc9

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/09/2026, 18:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__2b54aa3fdfb2d5c0e25f82f11a182943.vbs
Size 1KB
Sample260920-xkaecsys3k
SHA256 740f6afcbfc829264bacd9410c243834455bb8b4ae35bb02595a82ccd7b51fc9
MD5 2b54aa3fdfb2d5c0e25f82f11a182943
SHA1 ec8da51e35c0713560fe4fc5ee852b810648193f
SHA512 1ec023c61866f4e483500a15d34f8f87bb18fce6c54a22677b0d7a76e2ba6f573cd6fa5f091d91fc8f6e0e83d560026dbff07d4524fb4a9412d41dfc270c4176
TLSH
T165414BC4072A402ED0B2F15547D5D0592BF94BB7FCD2CFA996C857C075ABCCE82681D6
MD5 SHA1 SHA512 TLSH

Score

6^/10

adware execution persistence spyware stealer

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows OLE Automation Server = "C:\\Windows\\system32\\ole32aut.vbe"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\Windows OLE Automation Server = "C:\\Windows\\system32\\ole32aut.vbe"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows OLE Automation Server = "C:\\Windows\\system32\\ole32aut.vbe"	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
460	WScript.exe

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\SearchURL = "http://69.50.179.61/search/"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://69.50.179.61/search/se.html"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant = "http://69.50.179.61/search/se.html"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\CustomizeSearch = "http://69.50.179.61/search/se.html"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\SearchURL = "http://69.50.179.61/search/"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://69.50.179.61/search/se.html"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "http://69.50.179.61/search/se.html"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://69.50.179.61/search/se.html"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "http://69.50.179.61/search/se.html"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://69.50.179.61/search/se.html"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url1 = "http://69.50.179.61/search/"	WScript.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://69.50.179.61/search/"	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://69.50.179.61/search/"	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2b54aa3fdfb2d5c0e25f82f11a182943.vbs"
1⤵
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads