Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 10:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_8792987c896bdb67374044b403f5a62f635aa95cf76578171b85e5c5fd4f6d00.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target jaffacakes118_8792987c896bdb67374044b403f5a62f635aa95cf76578171b85e5c5fd4f6d00.exe
- Size 34KB
- Sample260930-mgs27axt5n
- SHA256 8792987c896bdb67374044b403f5a62f635aa95cf76578171b85e5c5fd4f6d00
- MD5 3f777082c42df5df535c7554a01d5870
- SHA1 fe5ccda1225827b9b60a9ebc7944afd9bd3d0223
- SHA512 02b2e847be4da09bee6b9b8c3b9fc8813fb8d9d269d9a73084451cd6c63260c760046c5b733481affb7fa2d17b8156bb01f38cb565602ee011a1e8c48908d1de
- SSDEEP 384:FVX5iiuU2w38RLKYUu4NOJ9qNoBv7H1OQJxIfxtD4gkejeKBKs6B2gvWArxWrLtk:7piizkl4+9qmZhlvIfMlke3s6cSXeo
- TLSH T1ACF2BF8BBAA544E2C3C528BA039E5169522EB16483453FC7DF4085C75CFB4E8E93C685
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run iebtm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Program Files (x86)\\Web Technologies\\iebtm.exe" iebtm.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000d00000001c56a-9.dat acprotect - Executes dropped EXE 2 IoCs
pid Process 5772 iebtm.exe 4088 iebtmm.exe - Loads dropped DLL 1 IoCs
pid Process 5772 iebtm.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B8301AF7-D00E-4EA4-87C1-5FF4644FBBA1}\ iebtm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects iebtm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B8301AF7-D00E-4EA4-87C1-5FF4644FBBA1} iebtm.exe -
resource yara_rule behavioral2/memory/5772-5-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/files/0x000e00000001c559-3.dat upx behavioral2/files/0x000d00000001c56a-9.dat upx behavioral2/memory/5772-12-0x0000000010000000-0x0000000010009000-memory.dmp upx behavioral2/files/0x000d00000001c56c-16.dat upx behavioral2/memory/4088-17-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/5772-26-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/4088-29-0x0000000000400000-0x0000000000407000-memory.dmp upx - Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\Web Technologies\iebtm.exe jaffacakes118_8792987c896bdb67374044b403f5a62f635aa95cf76578171b85e5c5fd4f6d00.exe File created C:\Program Files (x86)\Web Technologies\iebtu.exe jaffacakes118_8792987c896bdb67374044b403f5a62f635aa95cf76578171b85e5c5fd4f6d00.exe File created C:\Program Files (x86)\Web Technologies\iebt.dll iebtm.exe File created C:\Program Files (x86)\Web Technologies\iebtmm.exe iebtm.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4672 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_8792987c896bdb67374044b403f5a62f635aa95cf76578171b85e5c5fd4f6d00.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iebtm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iebtmm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" iebtm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" iebtm.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} iebtm.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\SearchScopes iebtm.exe Set value (str) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" iebtm.exe Set value (str) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.srchhere.com/index.php?b=1&t=0&q={searchTerms}" iebtm.exe Set value (str) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" iebtm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.iexplorergate.com/redirect.php" iebtm.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Search iebtm.exe Key created \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main iebtm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} iebtm.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID iebtm.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{B8301AF7-D00E-4EA4-87C1-5FF4644FBBA1} iebtm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B8301AF7-D00E-4EA4-87C1-5FF4644FBBA1}\ddd = "ddd" iebtm.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{B8301AF7-D00E-4EA4-87C1-5FF4644FBBA1}\InprocServer32 iebtm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B8301AF7-D00E-4EA4-87C1-5FF4644FBBA1}\InprocServer32\ = "C:\\Program Files (x86)\\Web Technologies\\iebt.dll" iebtm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B8301AF7-D00E-4EA4-87C1-5FF4644FBBA1}\InprocServer32\ThreadingModel = "Apartment" iebtm.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6128 jaffacakes118_8792987c896bdb67374044b403f5a62f635aa95cf76578171b85e5c5fd4f6d00.exe 6128 jaffacakes118_8792987c896bdb67374044b403f5a62f635aa95cf76578171b85e5c5fd4f6d00.exe 5772 iebtm.exe 5772 iebtm.exe 4088 iebtmm.exe 4088 iebtmm.exe 5772 iebtm.exe 5772 iebtm.exe 4088 iebtmm.exe 4088 iebtmm.exe 5772 iebtm.exe 5772 iebtm.exe 4088 iebtmm.exe 4088 iebtmm.exe 5772 iebtm.exe 5772 iebtm.exe 4088 iebtmm.exe 4088 iebtmm.exe 5772 iebtm.exe 5772 iebtm.exe 4088 iebtmm.exe 4088 iebtmm.exe 5772 iebtm.exe 5772 iebtm.exe 4088 iebtmm.exe 4088 iebtmm.exe 5772 iebtm.exe 5772 iebtm.exe 4088 iebtmm.exe 4088 iebtmm.exe 5772 iebtm.exe 5772 iebtm.exe 4088 iebtmm.exe 4088 iebtmm.exe 5772 iebtm.exe 5772 iebtm.exe 4088 iebtmm.exe 4088 iebtmm.exe 5772 iebtm.exe 5772 iebtm.exe 4088 iebtmm.exe 4088 iebtmm.exe 5772 iebtm.exe 5772 iebtm.exe 4088 iebtmm.exe 4088 iebtmm.exe 5772 iebtm.exe 5772 iebtm.exe 4088 iebtmm.exe 4088 iebtmm.exe 5772 iebtm.exe 5772 iebtm.exe 4088 iebtmm.exe 4088 iebtmm.exe 5772 iebtm.exe 5772 iebtm.exe 4088 iebtmm.exe 4088 iebtmm.exe 5772 iebtm.exe 5772 iebtm.exe 4088 iebtmm.exe 4088 iebtmm.exe 5772 iebtm.exe 5772 iebtm.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 6128 wrote to memory of 5772 6128 jaffacakes118_8792987c896bdb67374044b403f5a62f635aa95cf76578171b85e5c5fd4f6d00.exe 89 PID 5772 wrote to memory of 4088 5772 iebtm.exe 90 PID 6128 wrote to memory of 4672 6128 jaffacakes118_8792987c896bdb67374044b403f5a62f635aa95cf76578171b85e5c5fd4f6d00.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8792987c896bdb67374044b403f5a62f635aa95cf76578171b85e5c5fd4f6d00.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8792987c896bdb67374044b403f5a62f635aa95cf76578171b85e5c5fd4f6d00.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Program Files (x86)\Web Technologies\iebtm.exe"C:\Program Files (x86)\Web Technologies\iebtm.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Program Files (x86)\Web Technologies\iebtmm.exe"C:\Program Files (x86)\Web Technologies\iebtmm.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4088
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\awer0.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4672
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Web Technologies\iebt.dll
- Size 7KB
- SHA256 8f59295b3a731783aa4d4f515183a41912eddfa6a28d65c2681fd0158dfcdd86
- MD5 0d2972c425f016adf72048d64d4a6448
- SHA1 8964d2658adc3cefc3252bd4ab0a65fb830d2fac
- SHA512 c13d904ee3b8d266ceafbfe0e6d49d3f8076664c15cee9c6cfe23935c9f019451310f62506c513895a75df4540c20add0da060e6668ba88a24cb2b0a1b8b633a
- SSDEEP 96:Zak4oVG9x7ARAo+umaH5FnSE1yi0Wljyiji2YhsgLyffwV7mlvziLGFlA8us:7OARAymcfj0k5iPhJawwti0As
- TLSH T12BF18E051D3A2EFFD8B6243A034F95A87554311246B9B6889FA2D74D3CFA1D07A3D818
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Web Technologies\iebtm.exe
- Size 17KB
- SHA256 33989687abc05d9871bbb8c44f9242dd9821c408262ef4eaec5c3692daad10f1
- MD5 7e9bf0c2a9c6857c313b09fd5b372d3e
- SHA1 66709caffe7876638949d14970e7db60b77164b8
- SHA512 13441b1bca4e6a6c976e50b797590ae09fd654f3059434a3cbe75b55a7f9933881908994123a86d630130384a460eed943933e2a994e55400b76772254eb4cbd
- SSDEEP 192:fyE6pub9Z5Hr4NejoX9cJZBKQvP6Bv3N1676CGL0SZkSVFrIAOmQQl54fS+xIHAC:0gkejeKBKs6B2gvWArxWrLt9ot
- TLSH T1DF82D0843D7340DBC1C62CFB035E5435015EA5D9870237892E61C28B79BF8D8AE8EA9B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Web Technologies\iebtmm.exe
- Size 5KB
- SHA256 d7710a046ba13638a23c77fd0721fec354401306132fae9cf2e7370b3756a774
- MD5 3a6727f645cdee81e7c2c01bfa0ac654
- SHA1 63fd042b91c8fa602e788a5fb2bc19181e2d7e05
- SHA512 d9601c163d1fa2bcc0a2cf7814a8b53a37ae365ef6f157ac4589fb6df220b936033688aa5eb050f969f9c17b55594190effe6e059d3383a98f82acbc1cbd364b
- SSDEEP 96:v3gkYnYXkciiGK4UNcFtoVtrhPkUv31o:fb0ciwcytlkUv3i
- TLSH T12DB14AE35A31C462C7F6193F176A8C1623EAF8EC47963B443B2C909F148655C063E5A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\awer0.bat
- Size 366B
- SHA256 6a97004dd29ebd0f7a6f3b072a7a73c69a0df71752363d079c0cfdb11111f949
- MD5 9db3f0003f6ec8a44e3370d7a4c21ce2
- SHA1 958235c919612465a33c9a56dfb81e0b840c6427
- SHA512 004c8f8def0fc22e368464fc186636132cdd4c0900de8a33a284b76d501e0e20b3b1e8d1691b45ddacab089ef8ad698547b6126653a80391d054ed98542d7cf7
- TLSH T181E0D19447D9960D440CD05F4A72654DC1A54F9E3B8A3F658357C54853D0C1FF1D6609
- MD5 SHA1 SHA512 TLSH