Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 12:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_0ad2a66ea7b5fefd530a0f5797933ac8178734406ec62525c2e1597eb998ae70.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_0ad2a66ea7b5fefd530a0f5797933ac8178734406ec62525c2e1597eb998ae70.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target jaffacakes118_0ad2a66ea7b5fefd530a0f5797933ac8178734406ec62525c2e1597eb998ae70.exe
- Size 25KB
- Sample260930-pgzabaxake
- SHA256 0ad2a66ea7b5fefd530a0f5797933ac8178734406ec62525c2e1597eb998ae70
- MD5 4625cc0783bdf8588a3d9edc8c533755
- SHA1 0bf6458999d5e55557a25162f228529a4bcb4d18
- SHA512 3d9018fde28c1aca0e99278c3e156d9d2c8c1c00b7c03771d73e8f1c3c2543210e8faa0a26187a79c590ea49a1ae05816629dd61b4e4eb030be16048fc497bce
- SSDEEP 192:2P/fdJdD5a4WEigOGgBDO3ZWSuM4WHjWEMypEhYDr9ZCspE+TMwrRmK+vhOrtMwb:2HFTCyShWCEXaYueM4mud
- TLSH T17BC2094F4A5404E3DBA58F30A15FAAEA8D7871711FD4914B1B7248CC9D32F60EA1B72E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_0ad2a66ea7b5fefd530a0f5797933ac8178734406ec62525c2e1597eb998ae70.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 804feb4ade50dd01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f595d6568c78041904f5e7e998782ca000000000200000000001066000000010000200000009be4bdefa3f21b31fb00a602e748041f2d03d131bfb58dfd8c8eeba65a80422a000000000e80000000020000200000001813030a608a2d090f3e145b07aa047479f9a755513c67a7233709c8192855cb20000000dc00970bdd994d5c8d3841adc5c2059db8a25bed303eb2d08a58892462f4725740000000c57b811496ca91327ed36c12828a8490e731406e19e18ae9a9c69adad6076779a8e7f65bed2ce376487b5d6d7cf7f6c1b0d9c4a3af10cb881e244d3531d14f11 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f595d6568c78041904f5e7e998782ca0000000002000000000010660000000100002000000076e3aaae2df7b70483b8d4f083a14439e230f73cb66e9b7acd52569cb1a650cd000000000e800000000200002000000069efc8e710809a1c38ebcea9f91671e759eb13cabcbd08f6054c27a957c871d32000000096ce06fa57d238bf3e3b87ee6d84ff286ff592e0d47030072fda6aaa843619d840000000e03d029de70d9da8dfe3e6464729d14cf71c0b196fe50bc9f5a4817b848046f95843f0525bc84afe81c955b9dbcefa0b9acbd440974cda795946ea3032c7da1e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7099ed4ade50dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3942110330" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3942422794" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281365" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{13FEA3F8-BCC9-11F1-8F8C-6E24823C6C3E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281365" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497535698" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1392 iexplore.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3120 jaffacakes118_0ad2a66ea7b5fefd530a0f5797933ac8178734406ec62525c2e1597eb998ae70.exe 1392 iexplore.exe 1392 iexplore.exe 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE 2412 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3120 wrote to memory of 1392 3120 jaffacakes118_0ad2a66ea7b5fefd530a0f5797933ac8178734406ec62525c2e1597eb998ae70.exe 86 PID 1392 wrote to memory of 2412 1392 iexplore.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0ad2a66ea7b5fefd530a0f5797933ac8178734406ec62525c2e1597eb998ae70.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0ad2a66ea7b5fefd530a0f5797933ac8178734406ec62525c2e1597eb998ae70.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "http://ads.regiedepub.com/cgi-bin/advert/getads?did=43&tohto=titi&soso=sisih"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1392 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2412
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 7bbfea3c4b86e052f6c7c043ab8b86695e9e7f525cf54670ea3fed7eeb8fc07b
- MD5 c594b726a66926272d1a36f611dbee07
- SHA1 06692a4ae7abe3082ff08b78812de3b1c5e11251
- SHA512 0f0ee6de9885af7f67ac2aa53f021b49d3d9cb828025cfac627a6c9ca4b6b684c76d4f551763ed290b404695060b76901b701fb45288a58fd82e184ac9e1a309
- TLSH T11BF09E11A3B9D0D05BCEF4DD076D01B93160995F20D2032664BB49B45A417E73559530
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 255d197cc837ae86b7dc57548d194a65af46a480f8c95cb9b72c19faa33ff6a3
- MD5 c8e34477864955f42ea2e48fb6e18f5e
- SHA1 0b154f499b46460779bacb0e0abe60ebe5b4227e
- SHA512 c06d1df1bfafb4fea8cd1c72d03fc8c23ce4b573dd7e9eefb4b16b8ca1f89ad64a38ca8bb9dccf35b8cfe04a412b4c3e36ff203acc100a0ec9c92ea9c01eb8b8
- TLSH T199E07D3411FA411FE1F8E4754BD9752985AEF122142DA3B825D49B04B702A40AD03A2A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QYLG505P\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH