Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/09/2026, 03:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_e2a6c1ce04e294e6e74f65d2678a6678644ab857bf69f58f7365067679bbe0f6.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target jaffacakes118_e2a6c1ce04e294e6e74f65d2678a6678644ab857bf69f58f7365067679bbe0f6.exe
- Size 4KB
- Sample260924-d2ewmada84
- SHA256 e2a6c1ce04e294e6e74f65d2678a6678644ab857bf69f58f7365067679bbe0f6
- MD5 e19110a3025d744c4d0c01175556a532
- SHA1 328d63cb04539c38e3b379eadd2adde862212c7a
- SHA512 6a6ee3b73b1a6b4b1d0c3489bc0164db558a85f1c796f0785237fcb5fdb1256b2415d1f03012fd988a584928838d1197ce497066936289f099b49579efefe6bf
- SSDEEP 48:u/kIU7cNOpO6nj87uRaZCJAD6lzcZ4ALaUY2B+ZXv9TlsdzJxOWl:u2oMOMQ7utjlQxUZXFls7Zl
- TLSH T14BA1DA46AE5308F1D0C8DF38174502C1EFBA4C6B71979A3FDB88487519F608009E5EFA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_e2a6c1ce04e294e6e74f65d2678a6678644ab857bf69f58f7365067679bbe0f6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{80929A12-B7C8-11F1-8007-66DCEFAAD7CC} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31280085" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f916af097bf064c9e2f3ef66abc66e000000000020000000000106600000001000020000000d1c59fac1bfbfb9ffc64dc88b5fba9355782fcb74328b82d3d864d17368b8e3f000000000e80000000020000200000009e553716b85bb8ecb6bd9bc72d5e94bbc5a61fde95c8d886d45c736ed122a361200000005e8f6d7449e7d0dcee04623b32aa3a0040b0205ef5b13ba7bbae9c97b1a2096f400000000ca30ff97849644e203431c5b97f9dca7068f59c7bc05e09ede113571215bb3d747596a0edcb3462c1d9977dc776b83da9d997693dfa25634ddd6ef08e651f0d IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00bf96badd4bdd01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1427998403" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100492badd4bdd01 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "496985695" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31280085" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1435811009" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f916af097bf064c9e2f3ef66abc66e0000000000200000000001066000000010000200000001f1a1df1a6659490e6b867fd1719fdf14c0e21cc5bedab75aece66e856069397000000000e80000000020000200000006c2c2f3dfd7899f014f935911cbd6de4f31f2d2313c85fd37994d5c5f7d03d43200000003ef63894d1c4013fbb1c86a5368134f5860908f1b2ca59297ef28112f516e7bd4000000076f565f99cb87cf18099735bf181e03fba521767edc0e56e2afe991cfcba0746e9067e1a50c66fb014281318f4c312c0d45622a31bb07c01215f32c3c12a1ce1 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1192 IEXPLORE.EXE - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1192 IEXPLORE.EXE 1192 IEXPLORE.EXE 3320 IEXPLORE.EXE 3320 IEXPLORE.EXE 3320 IEXPLORE.EXE 3320 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4184 wrote to memory of 1192 4184 jaffacakes118_e2a6c1ce04e294e6e74f65d2678a6678644ab857bf69f58f7365067679bbe0f6.exe 86 PID 1192 wrote to memory of 3320 1192 IEXPLORE.EXE 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e2a6c1ce04e294e6e74f65d2678a6678644ab857bf69f58f7365067679bbe0f6.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e2a6c1ce04e294e6e74f65d2678a6678644ab857bf69f58f7365067679bbe0f6.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Program Files\Internet Explorer\IEXPLORE.EXEiexplorer.exe http://www.eccents.com/stat.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1192 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3320
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 08511289c08287b60d3de6815e0cdcfd976b76b4ed1fe052982d80b6c9cc3acf
- MD5 1b3bf1878b48e342615e88278c16912b
- SHA1 c03506a3fb6436b214e1adf8334537e30c16e9d6
- SHA512 0738abcb2be78e40a86a93c99dc4468279496d66d2351d02a564eb5d97c7b65e1aa01ac5562971f4fbbe65d56087e56b83b10335b5f724eedc942a429b2160af
- TLSH T1B0F0D414567C9D71399098DC27E816BF34B2E17F10451415B17945E40164FBADB1D035
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 188bd21bc50bb786a860a9aa92fd8fd057892ae3c1b7786c0c3277b08d0e3ac7
- MD5 8a9dcfe4f87384c65578c9b9d1628259
- SHA1 578f1001b929f01b096a30ad66da67c87d26fcc3
- SHA512 3bb342636cf2fbc5096bd7957dc3131566071fefe6fcd25c615be51689ed258311540924b8d6ff2081f8ba5edff4deddf3ea619aa8a169a57052e899e76b2396
- TLSH T1BAE0C03412FB411FF4F5F4784BD9B421866EF026142993B83AD49B08F707A00AC12925
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0OIDP0T3\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH