6f1d271ee755486566c9627d4e82b2973ddded3369851ee1b47135f9f9fc660a

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 06:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_6f1d271ee755486566c9627d4e82b2973ddded3369851ee1b47135f9f9fc660a.exe
Size 50KB
Sample260924-hb8s8sty2k
SHA256 6f1d271ee755486566c9627d4e82b2973ddded3369851ee1b47135f9f9fc660a
MD5 5a0e54ade9b9dc22937ede4cf0913234
SHA1 7892276bf43487fc52a4e554427fab96c79d5a40
SHA512 c2f9fc24643e109205fd5d8e21bafcd32184c16635e5bc4913d731149ee9c374e8bacd6b91a9012f484cbcf7b0af71523dece13882f5108eabc67fc8b9f8fdc4
SSDEEP 768:74OqjrEtNYS91Y+N+wt+Ro3g58lGnIAf7Q3sYnZB79pSzlhX22222c2F7XjpTX:sOqjrEN2+yvkAclZB7jSzzK1X
TLSH
T182336C01F6C28676E53066B8ED1790C4C7B2BDA118A6D34A76FD687C2D2F2805C4DBE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery execution persistence ransomware spyware

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_6f1d271ee755486566c9627d4e82b2973ddded3369851ee1b47135f9f9fc660a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ielowutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Suggested Sites\MigrationTime = 637a25c69242dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31280110"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a6591e7a63db8040be24f6739e2082430000000002000000000010660000000100002000000084415446819dcc19eefd078046b9af96664b2ba6dc5bf9e56bc0d4898f164b1a000000000e8000000002000020000000f72aefb5bdb34820dbc649ebbaeb9f5c8d506f39236c3136b05764d83fc41f81200000003c2e79795782a1eec1a8acdde979e02165ca28a11d2437d32b7a86dabf01fd4f4000000001e881d3ac1a1122c76ad4c272c4df367f4c226a9233b780176be49d687d2cb409cbb05d3e5f157c3c86493fb308e66360ac3ebae2bd3f98ba77abc8113430f8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Recovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3946899535"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main\ImageStoreRandomFolder = "g94wgob"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a007294ef74bdd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main\SearchBandMigrationVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a6591e7a63db8040be24f6739e20824300000000020000000000106600000001000020000000c2e4ae3a08da64e7d95ba3a5f580dcf0180a224d2f8c20b1b8beb0a9a6a05c5d000000000e80000000020000200000002b4569ba75245db9660056b617ceb72fad20bfdef5766adb11a4a4909b2f97cb20000000aae0a9875790863be204978b3c3675fc62961312a77d22b49c9024efe55ffed940000000618aab9b820244f06317cec086b613d6d8eb81f054277cf00b3ac8f6d655c553826cf39e4e0cc7a4a391b616c363947e99ff60616c891260ffd2c8541b1d03d8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Suggested Sites	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Suggested Sites\DataStreamEnabledState = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d42e4ef74bdd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16A04AAE-B7E2-11F1-B524-42EB048BA5BD} = "0"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings	jaffacakes118_6f1d271ee755486566c9627d4e82b2973ddded3369851ee1b47135f9f9fc660a.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5500	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5500	iexplore.exe
5500	iexplore.exe
5140	IEXPLORE.EXE
5140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 4560	1268	jaffacakes118_6f1d271ee755486566c9627d4e82b2973ddded3369851ee1b47135f9f9fc660a.exe	90
PID 5500 wrote to memory of 5140	5500	iexplore.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6f1d271ee755486566c9627d4e82b2973ddded3369851ee1b47135f9f9fc660a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6f1d271ee755486566c9627d4e82b2973ddded3369851ee1b47135f9f9fc660a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\F67FEB.js"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4560

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:2776

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5500
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5500 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:5140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F67FEB.js

Path C:\Users\Admin\AppData\Local\Temp\F67FEB.js
Size 4KB
SHA256 d3292f476c0f471b9c6f290daa7e2e6189df5c54cb7f23995ca89094643a3b95
MD5 a95d1e00bb6a9d2d2c7ab1726f5bff6b
SHA1 7100a94da83263ab7dc83c259422109e9814c631
SHA512 3e2969db41023acc11a72974fbb4bde3cdcb63e0421d84ca94a6644ca6d252e355574ad2053ee20c314c963b05467e8be56d23b604ddaef1ea655c9c2990b6a0
SSDEEP 96:0sMcb0WOqovTSjjCtrSAFctAg6z94o3DD3w+sXiHa+KewnlX7tXMUdfdG1aRQavD:0FWOqomjjCtNiqxz9n3DD3lsXi66wlX5
TLSH
T157A1532D5936208AF2ED4AA3A1BD765A49F9736353F71F0C1A0779C2C9B071ED00C86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1268-7-0x0000000000010000-0x0000000000022000-memory.dmp

Download