f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
Size 100KB
Sample261002-krss3atxds
SHA256 f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b
MD5 c5bfeb7ee48b25fa1c628b89ec196fc8
SHA1 d78d9b791964f655f7fcd54bc8f9abb66e4d4cc8
SHA512 3ecf4a0495d59bb3c8df398c14b35d13e7fd241aa0d31c160100ecc788d586a3ac75e01ed10d1c09f37f04f995b9d76f48cceae8dd9d3a39046d3613282484b8
SSDEEP 1536:haBqHQcurPTf3J9hBzb0mv8iMKZFYSLJ5C7ZPNER517WLQS2wWEY/YRSsI:lBG737zIm0wFYQ5eW717WLQxwsFsI
TLSH
T15DA35B61B2F38876D2B27E784E1BAE18587EBF613D68945977F81E0E4D382D4201D393
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\Z:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\E:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\I:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\L:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\M:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\W:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\A:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\G:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\J:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\Q:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\R:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\T:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\X:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\N:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\O:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\U:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\Y:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
	\??\F:\	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\B:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\H:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\K:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\P:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened (read-only)	\??\S:	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497696005"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281739"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "661568687"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281739"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{529522EB-BE3E-11F1-9982-7A0C86DD99A0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "660318328"	iexplore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1828	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
868	iexplore.exe
868	iexplore.exe
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 868	1828	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe	87
PID 868 wrote to memory of 1908	868	iexplore.exe	88
PID 1828 wrote to memory of 868	1828	jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe	87

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f2917f3ee744cefe338616ff8d890d486b3968b530beee55687fe2b02f07081b.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:868 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 06fe9ecf09fe90f243a993c5257ff5eb95fd9e57c1e8774954d7e247ecc38a45
MD5 4193e41f442e7d04a7f3d0ebf4ba067c
SHA1 3469d96329436fd9f3a2f68cdcfbc1e2c5f5aef4
SHA512 40d5c9f3ff6db2369e45da7be83a62ce3f886ae4e62b4cf23b8744cf020077d8ee1f2047c08af2b3701ba6f10eedccc1388563f9b88282ab33951f1afbc82f23
TLSH
T111F0D4F341BDB8542FD164DC41BDD93E313194A7118342C1357D89E684593776F8E532
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 f03a4b5212ab8f25e098b4df6d88324fcb905626c2be0318923f6565979b7934
MD5 060ed43047a3adb4ea49c13c4378752a
SHA1 78b8fbad5feaa2b54b0d966a4e308e423200dfc6
SHA512 566c2daf27a1b0d2a09948eb47e911dce47645fe3161ce64d1a000352de5f4b88a9c3ff4d59b5d73d16d073ea81fd52ab8bbde5ec705e602af53faf4b9344563
TLSH
T1A6E0C03411F6015FF0F4E4358BDA743594B9F0261418A7B42AD49B04A702A00AC03A29
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9JFLGHHP\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1828-30-0x0000000013140000-0x000000001315F000-memory.dmp

Download

memory/1828-38-0x0000000013140000-0x000000001315F000-memory.dmp

Download

memory/1828-13-0x0000000013140000-0x000000001315F000-memory.dmp

Download

memory/1828-16-0x0000000013140000-0x000000001315F000-memory.dmp

Download

memory/1828-18-0x0000000013140000-0x000000001315F000-memory.dmp

Download

memory/1828-0-0x0000000013140000-0x000000001315F000-memory.dmp

Download

memory/1828-33-0x0000000013140000-0x000000001315F000-memory.dmp

Download

memory/1828-3-0x0000000013140000-0x000000001315F000-memory.dmp

Download

memory/1828-1-0x0000000013140000-0x000000001315F000-memory.dmp

Download

memory/1828-34-0x0000000013140000-0x000000001315F000-memory.dmp

Download

memory/1828-36-0x0000000013140000-0x000000001315F000-memory.dmp

Download

memory/1828-37-0x0000000013140000-0x000000001315F000-memory.dmp

Download

memory/1828-32-0x0000000013140000-0x000000001315F000-memory.dmp

Download

memory/1828-40-0x0000000013140000-0x000000001315F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads