Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 22:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_a6d4ddff802df74ba191cec0c81eeb3af857d7d28fc3aa1e7d015de9a04080f6.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target jaffacakes118_a6d4ddff802df74ba191cec0c81eeb3af857d7d28fc3aa1e7d015de9a04080f6.exe
- Size 39KB
- Sample260925-15qtma1sbx
- SHA256 a6d4ddff802df74ba191cec0c81eeb3af857d7d28fc3aa1e7d015de9a04080f6
- MD5 def9c9fe0e05db312b66e7e41ce726e1
- SHA1 dac0087a9793c7031c4bc0c252f7175b10b30b59
- SHA512 d4de70fd158538e55185441a8c4ea4bc9218afb624080236742667d40b86b641c091e52df007856d0fdb71a200b4234dd5b69f9f0edb23be3036987e04bd28cd
- SSDEEP 768:tVXXASJPyyfM40nbcuyD7Uj0jK3QPNS2j0rSkGSqih5Q7+nbcuyD7U:tVHA2yyl0nouy8ehQrSVSq7+nouy8
- TLSH T15F03B017E7E989F0D3AE0137181F26067D64B22D92CA9F57EBC4312B9872BE4D51C362
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Program Files (x86)\\NetProject\\sbmntr.exe" sbmntr.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000c00000001c603-8.dat acprotect - Executes dropped EXE 2 IoCs
pid Process 4364 sbmntr.exe 256 sbsm.exe - Loads dropped DLL 1 IoCs
pid Process 4364 sbmntr.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects sbmntr.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88} sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88}\ sbmntr.exe -
resource yara_rule behavioral2/files/0x000d00000001c5fd-3.dat upx behavioral2/memory/4364-4-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral2/files/0x000c00000001c603-8.dat upx behavioral2/memory/4364-11-0x0000000010000000-0x000000001000B000-memory.dmp upx behavioral2/memory/4364-17-0x0000000000400000-0x000000000040D000-memory.dmp upx - Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\NetProject\sbmntr.exe jaffacakes118_a6d4ddff802df74ba191cec0c81eeb3af857d7d28fc3aa1e7d015de9a04080f6.exe File created C:\Program Files (x86)\NetProject\sbun.exe jaffacakes118_a6d4ddff802df74ba191cec0c81eeb3af857d7d28fc3aa1e7d015de9a04080f6.exe File created C:\Program Files (x86)\NetProject\sbmdl.dll sbmntr.exe File created C:\Program Files (x86)\NetProject\sbsm.exe sbmntr.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sbmntr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sbsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_a6d4ddff802df74ba191cec0c81eeb3af857d7d28fc3aa1e7d015de9a04080f6.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} sbmntr.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\SearchScopes sbmntr.exe Set value (str) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" sbmntr.exe Set value (str) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.gatetofind.com/index.php?b=1&t=0&q={searchTerms}" sbmntr.exe Set value (str) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" sbmntr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} sbmntr.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.ieservicegate.com/redirect.php" sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" sbmntr.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Search sbmntr.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88} sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\xxx = "xxx" sbmntr.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32 sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ = "C:\\Program Files (x86)\\NetProject\\sbmdl.dll" sbmntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ThreadingModel = "Apartment" sbmntr.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID sbmntr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4844 jaffacakes118_a6d4ddff802df74ba191cec0c81eeb3af857d7d28fc3aa1e7d015de9a04080f6.exe 4844 jaffacakes118_a6d4ddff802df74ba191cec0c81eeb3af857d7d28fc3aa1e7d015de9a04080f6.exe 4364 sbmntr.exe 4364 sbmntr.exe 256 sbsm.exe 256 sbsm.exe 4364 sbmntr.exe 4364 sbmntr.exe 256 sbsm.exe 256 sbsm.exe 4364 sbmntr.exe 4364 sbmntr.exe 256 sbsm.exe 256 sbsm.exe 4364 sbmntr.exe 4364 sbmntr.exe 256 sbsm.exe 256 sbsm.exe 4364 sbmntr.exe 4364 sbmntr.exe 256 sbsm.exe 256 sbsm.exe 4364 sbmntr.exe 4364 sbmntr.exe 256 sbsm.exe 256 sbsm.exe 4364 sbmntr.exe 4364 sbmntr.exe 256 sbsm.exe 256 sbsm.exe 4364 sbmntr.exe 4364 sbmntr.exe 256 sbsm.exe 256 sbsm.exe 4364 sbmntr.exe 4364 sbmntr.exe 256 sbsm.exe 256 sbsm.exe 4364 sbmntr.exe 4364 sbmntr.exe 256 sbsm.exe 256 sbsm.exe 4364 sbmntr.exe 4364 sbmntr.exe 256 sbsm.exe 256 sbsm.exe 4364 sbmntr.exe 4364 sbmntr.exe 256 sbsm.exe 256 sbsm.exe 4364 sbmntr.exe 4364 sbmntr.exe 256 sbsm.exe 256 sbsm.exe 4364 sbmntr.exe 4364 sbmntr.exe 256 sbsm.exe 256 sbsm.exe 4364 sbmntr.exe 4364 sbmntr.exe 256 sbsm.exe 256 sbsm.exe 4364 sbmntr.exe 4364 sbmntr.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4844 wrote to memory of 4364 4844 jaffacakes118_a6d4ddff802df74ba191cec0c81eeb3af857d7d28fc3aa1e7d015de9a04080f6.exe 89 PID 4364 wrote to memory of 256 4364 sbmntr.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a6d4ddff802df74ba191cec0c81eeb3af857d7d28fc3aa1e7d015de9a04080f6.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a6d4ddff802df74ba191cec0c81eeb3af857d7d28fc3aa1e7d015de9a04080f6.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Program Files (x86)\NetProject\sbmntr.exe"C:\Program Files (x86)\NetProject\sbmntr.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Program Files (x86)\NetProject\sbsm.exe"C:\Program Files (x86)\NetProject\sbsm.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:256
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\NetProject\sbmdl.dll
- Size 10KB
- SHA256 feff23f82b0556b145acdd5ea3f4da2582abf6567f0d0ad54eb15bdfd15a9cf9
- MD5 8ac5c4e5765360e409f6e7d60ee3d86f
- SHA1 027f9513ae003dc842533586a85947b7ce229247
- SHA512 1cead8a5d55e6e88ff7676f3495688f59cb2991c562282f8a8d4bd7739e6d445d97b38cdb115b0e551e52f75aeeb224758a69d5439e97a179610402f411f611d
- SSDEEP 192:ct/xIxbvYf2kXpZZEfE+oFaNJhLkwcud2DH9VwGfctQ/U:ct5yA2k5ADcaNJawcudoD7UW
- TLSH T14A228D47C66B87A8C09C41360C9FFC4E1794E22DE1C06AE6B6C42177E984F7C6C28A91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\NetProject\sbmntr.exe
- Size 19KB
- SHA256 10e1da579988d54dbdc353254ca0bb39f6ec6017fa8fb3f72e784fcf16f40feb
- MD5 3e3ef49c846543a4b284d54bbe1dc70e
- SHA1 f1830871007ce7e6739d2d2a812a90f282a897a2
- SHA512 a2fc16a39621ea29e0b11d8ae55c952fb411ffc0ef8dbaa72202fcea1e855499d3f7f1b81417e36911b651fe10067086a28287fe4b94015830470b9ba1b44259
- SSDEEP 384:n0j364mQPiEyHQ19c6x0rSkGSqihaDZyvaJ7Oa7H7aNJawcudoD7U1:n0jK3QPNS2j0rSkGSqih5Q7+nbcuyD7U
- TLSH T17292C017E7E94A90D25B833B1D1F360AAC58C31DB7E58B6B31C0313F5563BBC6618222
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\NetProject\sbsm.exe
- Size 5KB
- SHA256 4c8207d5af11ea61a5bad1f8743a399596fb8768b73b8acd1bca65d310cf65a8
- MD5 c28d57d1894f3b2efccee5b55689ced5
- SHA1 4f3884dfa98121d1da4f3748084fd4437d1fae55
- SHA512 21049018685511e8942ffc3c7538f5987bba0b5cf5e22769e057379553526e8aedebf987c6e2775a7ef5a6ca2460c02b16fe0155ab3efbea2d9cf73767accc2f
- SSDEEP 48:KM84G0IMGMvW28G88JSnR7DMrtiV0xcR1px1WiIZJvMV6vMjTvI49Bd1Lzmi:3nVvWUyR7ortiV04xM3BnE3I49rxmi
- TLSH T168B1D99EFE1009FAE0E800312C5E1D6A43F6F43B5374A1F78E73A5D6DAA1DE53129642
- MD5 SHA1 SHA512 SSDEEP TLSH