Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 12:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_d5ef9a73f2de63a69f78416e59bad869e770fc081dbd33ef8438be07c43bb06c.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_d5ef9a73f2de63a69f78416e59bad869e770fc081dbd33ef8438be07c43bb06c.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target jaffacakes118_d5ef9a73f2de63a69f78416e59bad869e770fc081dbd33ef8438be07c43bb06c.exe
- Size 25KB
- Sample260930-ph4lesty2n
- SHA256 d5ef9a73f2de63a69f78416e59bad869e770fc081dbd33ef8438be07c43bb06c
- MD5 fe2f51021dc951bd5c9bd0ed647895dc
- SHA1 08866fe7a298188936182a09e49a9a391b715a2a
- SHA512 e637795e4cd5bde4516ca6320baf3d7272108c8f3e50700f13a78e248cd0cece502b142fd511b5474ba65fa70b7bc085ea103b978fda60850a2db1d99e8cf501
- SSDEEP 192:zP/fdJdD5a4WEigOGgBDO3ZWSuM4WHjbEMdpbKr9ZCspE+TMwrRmK+vhOrVR:zHFTCyShWXE0pXeM4mcR
- TLSH T1FCC2084F4B1404A2DBA5CF70A05FAAEA8D7872710FE55147177248CCAC72F90DA4A63F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_d5ef9a73f2de63a69f78416e59bad869e770fc081dbd33ef8438be07c43bb06c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 500510d2de50dd01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281366" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281366" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9AD24CB8-BCC9-11F1-9982-466A5CF93802} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497535925" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1870411321" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c014d2de50dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000592c972055b30f42897d4dd4c712190b0000000002000000000010660000000100002000000071c6058997105acb9a8df9e140c7c8003c95c72b3193583a239b32485c71d081000000000e8000000002000020000000816c86ca51c416a279ad84bd54231340f2b8ea3f67a5da228220efb85f5624692000000061509e08e9d797234bbcd7f75b0080995db040a2ae1c676317c17fc34db198e040000000e04b7a3c26034fa6c11640dca9d12fc3b4cb782eb6cb0b8bfe1ceaf89a86f121a52e8e871f3f8fa98237063a13d2a0672bb93d3ec97425c6130536c097f9f34d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1875255380" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000592c972055b30f42897d4dd4c712190b0000000002000000000010660000000100002000000059e76807c5c7f319cb792d6ec3445dbca93ba1d03e820216b51cf3a8e8877032000000000e80000000020000200000008a146abef4a8b86142c5ea0a52e051cd2d748095811077499bbd6e0f56958815200000004e1b6f488cc2ed33e7ce98247c64fb21024a4dbea31f0c8417608969d1ccf6f5400000000e151b4c08e95fdd511223febb774e5d78af7f1a1468d099bdf68fffa4ed04aa35af717251cb43b170a86cfdb35a0cb3645f9b111a7a86698a0fe24a24a57048 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1008 iexplore.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4588 jaffacakes118_d5ef9a73f2de63a69f78416e59bad869e770fc081dbd33ef8438be07c43bb06c.exe 1008 iexplore.exe 1008 iexplore.exe 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4588 wrote to memory of 1008 4588 jaffacakes118_d5ef9a73f2de63a69f78416e59bad869e770fc081dbd33ef8438be07c43bb06c.exe 87 PID 1008 wrote to memory of 2916 1008 iexplore.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d5ef9a73f2de63a69f78416e59bad869e770fc081dbd33ef8438be07c43bb06c.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d5ef9a73f2de63a69f78416e59bad869e770fc081dbd33ef8438be07c43bb06c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "http://ads.regiedepub.com/cgi-bin/advert/getads?did=433&tohto=titi&soso=sisih"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1008 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2916
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 7bbfea3c4b86e052f6c7c043ab8b86695e9e7f525cf54670ea3fed7eeb8fc07b
- MD5 c594b726a66926272d1a36f611dbee07
- SHA1 06692a4ae7abe3082ff08b78812de3b1c5e11251
- SHA512 0f0ee6de9885af7f67ac2aa53f021b49d3d9cb828025cfac627a6c9ca4b6b684c76d4f551763ed290b404695060b76901b701fb45288a58fd82e184ac9e1a309
- TLSH T11BF09E11A3B9D0D05BCEF4DD076D01B93160995F20D2032664BB49B45A417E73559530
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 d0120d5fe2f3adddbe15b7f91f38aa435fbb87652931bc04684bdbbe56fb2cf9
- MD5 6e1c4ecf1b72e215ad96cb5aeb92a6ac
- SHA1 51ed26569ab72c8e2ee378d06b7638bc9929651d
- SHA512 2b4fefe96edfa2f27a6afcc1a529eb65bc9790ca82dd3b5f7d1ecb73bc2ff02727b0dee0cfbb0fb79a95fb3b41e20bbdc496568c816fdac23178e33de0b61a9c
- TLSH T194E0C03811F7411FE0E4E8344BC97421546DF026141892F42ED48F08B706A40AC12A29
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y8RORA7G\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH