Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 06:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe
- Size 26KB
- Sample261002-gzaqnstyct
- SHA256 1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00
- MD5 f69af12f0d4464db374d4c607a0e6181
- SHA1 bca208bf8395ceb43fccc6432242e9334b1bcfc6
- SHA512 b046f8cb670606f4a273ca3110dade8aa6becc10f69d024ceb2222f6d39ae7ad2179d08b94f86a976e9dd7168386fdf6c34fb404ea9f9ffac86d894e7044a31b
- SSDEEP 384:bCHIgKqMLwpWPFpSzPK/IPMjard615JFAYVd1YaNJawcudoD7U:bCoMMLoWdpSzPK/lAiQQtnbcuyD7U
- TLSH T115C27C4BE66402F2D7B8003204AF2D1E6B75E52913D5BDE7CBD56093ACA2FE0D83C656
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe" jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000d000000019cb7-1.dat acprotect - Executes dropped EXE 1 IoCs
pid Process 4548 sbsm.exe - Loads dropped DLL 1 IoCs
pid Process 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe - Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6860A44B-5D3E-433D-A7B5-D517F810D0E7} jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}\ jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe -
resource yara_rule behavioral2/files/0x000d000000019cb7-1.dat upx behavioral2/memory/4152-2-0x0000000010000000-0x000000001000A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sbsm.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Search jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\SearchScopes jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.searchinggate.com/index.php?b=1&t=0&q={searchTerms}" jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.safeiegate.com/redirect.php" jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{6860A44B-5D3E-433D-A7B5-D517F810D0E7} jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}\xxx = "xxx" jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}\InprocServer32 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sbmdl.dll" jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6860A44B-5D3E-433D-A7B5-D517F810D0E7}\InprocServer32\ThreadingModel = "Apartment" jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4548 sbsm.exe 4548 sbsm.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4548 sbsm.exe 4548 sbsm.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4548 sbsm.exe 4548 sbsm.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4548 sbsm.exe 4548 sbsm.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4548 sbsm.exe 4548 sbsm.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4548 sbsm.exe 4548 sbsm.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4548 sbsm.exe 4548 sbsm.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4548 sbsm.exe 4548 sbsm.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4548 sbsm.exe 4548 sbsm.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4548 sbsm.exe 4548 sbsm.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4548 sbsm.exe 4548 sbsm.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4548 sbsm.exe 4548 sbsm.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4548 sbsm.exe 4548 sbsm.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4548 sbsm.exe 4548 sbsm.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4548 sbsm.exe 4548 sbsm.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 4548 sbsm.exe 4548 sbsm.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4152 wrote to memory of 4548 4152 jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1fe8a647d1cfb4fd6756904d1f7aa38d01c7d9da60d6906ca7288abdd29e9b00.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\sbsm.exeC:\Users\Admin\AppData\Local\Temp\sbsm.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4548
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\sbmdl.dll
- Size 10KB
- SHA256 facdd382a55c3c002d302a4e023ce98159d92a2fd46b285dff21f5997275c6fe
- MD5 1ca97c3a76fc45c24eba315f0204ec74
- SHA1 313b1c9d7be52eb875c6b5a18266954097a5ad98
- SHA512 6bd579d39510da7ca4a731eecb07173f0afbd7d134ef254fef15059aa11edb8bc8bdedd9950603e682c516a5bcf1a0c2629ceef88d82cffffd4a71a08a4857d0
- SSDEEP 192:kQVrUG61EpgXJsCd5HMtCtZxfdtfr9OFaNJhLkwcud2DH9VwGfctQTH:7rd615JFAYVd1YaNJawcudoD7U
- TLSH T110224B46C26B56D5C4AD003B0C7F6D0B1860D22CBED91AFA5BE5303784D6B286879F51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\sbsm.exe
- Size 5KB
- SHA256 cb705a13e92c0caf2b7c3aa1eec8a0458a0860384dc7c9a217c3a5e3d29e60d9
- MD5 187858715e5ef0cc61f8415d291f716d
- SHA1 c8fd61e68359ab5b86c452239f62ab061b2c81da
- SHA512 c80d584e13bb09f3eec3b08475c9543f37b621bf9201ae1d85b861e5090595525745685bd2065d199aefe79cdba4368c3c98b3049a371b7fa4228945481c8db0
- SSDEEP 96:jkaG9Gt2vKhNTVqGP3M3BWycrgIP6xmi:jw4eM5PGBtVIPMmi
- TLSH T196B109AFF75005F6D4F90071095E1D2E53B6F0360364A0F38677A9D3EAA1DE13438681
- MD5 SHA1 SHA512 SSDEEP TLSH