011ecee61345d52678268dd21ad67479b30207e084bf339d7e3387c9284192ce

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_011ecee61345d52678268dd21ad67479b30207e084bf339d7e3387c9284192ce.exe
Size 49KB
Sample260924-j2n27ahd64
SHA256 011ecee61345d52678268dd21ad67479b30207e084bf339d7e3387c9284192ce
MD5 6a6978570984e6bfe3aff227e4d6bd0c
SHA1 34ae8bb5fbbb68a10da2f897ac1b5291ce3aeca3
SHA512 9792febb1ae9bae93bcb26f38cb9c5fe9b584c3f2aae679a176281b4aadfc4d0adc51b7f9e3d07531294478a23b8089c529fc0a859347fdd890694f907f815c6
SSDEEP 768:tMqqjBE3njHAZdl2qr9N5BWUF+Yq0E+Mz2AgUdP/qYAf1KXj:eqqjBEXjAZdl2ytM0EyAgUx/qd
TLSH
T1A6332A3275908039C0A0AC397EFAE6C75661B5EC9E1A05C23E6A97CD0EFD7701C5F899
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery execution persistence ransomware spyware

Malware Config

Signatures

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_011ecee61345d52678268dd21ad67479b30207e084bf339d7e3387c9284192ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ielowutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b5ae68144cdd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Recovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3118EE5D-B7FF-11F1-A03F-721A714DA675} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\SearchBandMigrationVersion = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Suggested Sites\MigrationTime = 53a458e29042dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31280140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\ImageStoreRandomFolder = "5m67qul"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7070b368144cdd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000038d24efa61044140b0ae3d109f1675ea00000000020000000000106600000001000020000000fa3e1f659f73dc566de4074833e1fac973b355d06f3a0d15bdbb65456b09112c000000000e800000000200002000000003c90d27504569113c47a5457a382f153d3aa372995487829ed0c0148b85b86d2000000071ad246f0696ba945da9c3f4dec858fd4baa140782440ed43ec29884e9d5c32a400000005017f9efff8bcb5601ee23ce9af522b323149829c0fb1074e93737af5a0d9a3ce3f8231e57c37b53f969fc8a953a583ef4abfbcd27d6cbf4135b006493ddbcdd	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Suggested Sites\DataStreamEnabledState = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\DOMStorage\oo.lv	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Suggested Sites	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\DOMStorage\oo.lv\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "94758894"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000038d24efa61044140b0ae3d109f1675ea00000000020000000000106600000001000020000000b470abc0164d8eec473af05ec31ea8dfc7a1a100726f3f9c658397caf49d7da6000000000e800000000200002000000006dd0e486e8dc0cb53f0ec8bf7009696445c162b416b4e294fdf8c2b6e51e87b200000008679c114f7cea68ec25bc69568046af3481f4798e548872d47340d08f79936f3400000001a58fc68361f37af955a3ad25a21cfa5ee6266b80496ea2e648f296592a38392aea1eacba0bf0bf0e42216dcad0d4bc8bfdd5a78db3c48e4eba1c1ac177991ee	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2440	iexplore.exe
2440	iexplore.exe
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 4328	2152	jaffacakes118_011ecee61345d52678268dd21ad67479b30207e084bf339d7e3387c9284192ce.exe	90
PID 2440 wrote to memory of 2876	2440	iexplore.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_011ecee61345d52678268dd21ad67479b30207e084bf339d7e3387c9284192ce.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_011ecee61345d52678268dd21ad67479b30207e084bf339d7e3387c9284192ce.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\DUOMlMmQyC.js" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_011ecee61345d52678268dd21ad67479b30207e084bf339d7e3387c9284192ce.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4328

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:2624

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

favicon[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WR34X31D\favicon[1].htm
Size 291B
SHA256 014c471c07b2bc1b90cf5b46eb8eb60abe3ac278e43cd8fcc7c4e6c8950c592d
MD5 b73189024a094989653a1002fb6a790b
SHA1 0c44f096cd1fec253c1fe2fcfcd3c58fe05c402d
SHA512 1bca726835d33847812060c968e5306535f513429de5c90d66942155fd42ff75508dba97da8ca36c6d6e6a8df5a2602fe3be047bb5612ad4e367c6c00e1e50a3
TLSH
T1FDD02BF73C01071147F197D014C1A28A50B7159DDCD2DC9042A3E4AD0580FA9CA875B4
MD5 SHA1 SHA512 TLSH

Submit Download

DUOMlMmQyC.js

Path C:\Users\Admin\AppData\Local\Temp\DUOMlMmQyC.js
Size 10KB
SHA256 b4702b054221e50cc14a66ae866533f1c33d6fee7fce9affc6974e1835d62a25
MD5 62d43af02e5f9526e9b5d231f9034908
SHA1 35ecc24e7f5c211ee29d32f328ff26cd66746118
SHA512 2943fa73aad1e2063a9ca6b3700e6594bc474787b5aa28802be28066543d069f7f4977811c30b69b4c7f1077ffd5dc17142c8efdb9c69727e324d415b4936bed
SSDEEP 192:h/M3YJOAt8DNNkwzh2HpV1lo4gtgJvVNLiervMGI7qoCg4OABw2OloqvOUHynpA:q74XOQA
TLSH
T1632268656F0C4831B31C1FD4AA6FDA6DBEEB33362D17B60BB813769F1A6856C8041718
MD5 SHA1 SHA512 SSDEEP TLSH