Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 22:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe
- Size 22KB
- Sample260925-16ccmayv6m
- SHA256 5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d
- MD5 a01b2343deb6718e5b9befcdc9c4e288
- SHA1 f91b379131b66b7e2d57d2d5fcd3b76eb7e3641a
- SHA512 72a6b8621919f10b1981c53f708418831b0988dfb65febaa3851db2cf1aefe7c1c772e807762d7c3e95ac3f7ff4c7076ac441ef779c742aad74e3e6a8ecf974d
- SSDEEP 384:L3k0AGkSsKFKmna7Vso5gIJDuQitss1gv2WaS:bk0MHKlnwComDQ0gv2BS
- TLSH T1A3A26B4BBA9446B3E3E5117101DA0849377BA479439ABC87CFD4A2077CF71D0E62D29B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe" jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x00160000000115b6-1.dat acprotect - Executes dropped EXE 1 IoCs
pid Process 4104 sbsm.exe - Loads dropped DLL 1 IoCs
pid Process 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe - Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88} jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88}\ jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe -
resource yara_rule behavioral2/files/0x00160000000115b6-1.dat upx behavioral2/memory/3496-2-0x0000000010000000-0x0000000010009000-memory.dmp upx behavioral2/memory/4104-9-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/files/0x000e00000001c558-8.dat upx behavioral2/memory/4104-11-0x0000000000400000-0x0000000000407000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sbsm.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe Set value (str) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe Set value (str) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.searchagate.com/index.php?b=1&t=0&q={searchTerms}" jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.gateietool.com/redirect.php" jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe Key created \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Search jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe Key created \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\SearchScopes jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe Set value (str) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe Key created \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88} jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\xxx = "xxx" jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sbmdl.dll" jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ThreadingModel = "Apartment" jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 4104 sbsm.exe 4104 sbsm.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 4104 sbsm.exe 4104 sbsm.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 4104 sbsm.exe 4104 sbsm.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 4104 sbsm.exe 4104 sbsm.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 4104 sbsm.exe 4104 sbsm.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 4104 sbsm.exe 4104 sbsm.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 4104 sbsm.exe 4104 sbsm.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 4104 sbsm.exe 4104 sbsm.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 4104 sbsm.exe 4104 sbsm.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 4104 sbsm.exe 4104 sbsm.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 4104 sbsm.exe 4104 sbsm.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 4104 sbsm.exe 4104 sbsm.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 4104 sbsm.exe 4104 sbsm.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 4104 sbsm.exe 4104 sbsm.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 4104 sbsm.exe 4104 sbsm.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 4104 sbsm.exe 4104 sbsm.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3496 wrote to memory of 4104 3496 jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5401f05895de942fbfa32a4e9b32d6a5dd2eb8be1a92d38dbd9b19f83c61734d.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\sbsm.exeC:\Users\Admin\AppData\Local\Temp\sbsm.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4104
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\sbmdl.dll
- Size 7KB
- SHA256 06ef22413b05c342a5383afb8b1d4bfd826e5c514b9a25cfc34489d3936097a3
- MD5 82da3035bb79351430cb95d687246058
- SHA1 e3bb2faa9d32482138bd075b2a5e8054a6510ccb
- SHA512 7aa8db1f0247c76a114eff5eed9cd6f2155cdd7f6ef8a1236811eda06945c2ff194826d0bc10107345828b1ac61c386dae99e073dc4ccb1623b29d4c6a448296
- SSDEEP 192:VJkss16S67LixSlBIhzWAkkdwaRurfZC:css1gv2WaS
- TLSH T1EBF18E837956A165F0FC413455CB8994372AB0144FBD6B11BC78611B7CE7090EA4B6F2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\sbsm.exe
- Size 4KB
- SHA256 99271ab8bb4fe068879e0f37224c4a122ad7af66309dd3298ac6835bd79ba262
- MD5 16e9dfbdbd29bc402461a228e935cc19
- SHA1 5d9b532cf94e0a5f1976e0ae09ae7c9f147b548f
- SHA512 9d6165768b0975e23a0efae3b3a1a97200f3975b706bbde3a544e6ee1220cacac7430f74a98c178c6b98faa258cee8857354734269120b7628f6910caa776f89
- TLSH T1FF812B47EFF05637C281BFB7225E4C8731AEB53847BED5860D8C601379AA124132E617
- MD5 SHA1 SHA512 TLSH