3c9342566b7dc5d9f104ce28501d688665c3085366e4abe47446932adeba7e81

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 219KB
Sample261014-clpv8aev2w
SHA256 3c9342566b7dc5d9f104ce28501d688665c3085366e4abe47446932adeba7e81
MD5 3eb15c90583a61d4f643f99f7fe168cf
SHA1 c13ae1f565f6eb76a005fa881629a73d5a85485c
SHA512 8dcbfead73dd5712d31258f5c15a816c55a049889ecbe793404a718f60804df1dd05f622f3e4d1ba617ee7d0d388f15f39d2d9c3784e152fc8415d6f0d8e8567
SSDEEP 6144:IWWYSjuoCrfs22LkJcu+Txc5snyUFWgH7u:dWYSjFCp+TxOGFWgbu
TLSH
T1272402506C675533DE9E3071C6865EC4D4AE14A33752E82FCFA35939983A809EDAE02F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2bf41070-b2b1-21d1-b5c1-0305f4055515}	svcr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2bf41070-b2b1-21d1-b5c1-0305f4055515}\StubPath = "C:\\windows\\svcr.exe"	svcr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2bf41070-b2b1-21d1-b5c1-0305f4055515}	svcr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2bf41070-b2b1-21d1-b5c1-0305f4055515}\StubPath = "C:\\windows\\svcr.exe"	svcr.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4268	svcr.exe

Executes dropped EXE 2 IoCs

pid	Process
6036	svcr.exe
4268	svcr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\svcr.exe"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\svcr.exe"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svcr.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File created	C:\Windows\svcr.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svcr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svcr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 56 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "936184094"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "892121572"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31284097"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{601EA379-C774-11F1-B5F1-CEB19BEEF4E1} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31284097"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5800000058000000de040000bd020000	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a00000000020000000000106600000001000020000000749120bd5f2acafa656151a41aa2a35680ce37317708ec9fd92f19e32370d37f000000000e8000000002000020000000ca214070b63a570e79c03b34f0392cd26c98aa7705d950f9271d98523104f39a500000008faba6241c1d27346ff262002c69cb5e8799fc30076eabba9f7077ae7d2a207cc06b256963ca72167e94c5943be1e36d19f22336ffbf42e6427c36405b54372cc3f7edcf35110d9463844f78c7559d5040000000a4c834dfdf80cfe540cded558db48362a40137d77d7c3d7f7019c64a59d8481283cce48eecdf4bc8662bf249bf37a8e38a537daca0809fed7a0be1c61d34ac4f	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31284097"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IENTSS"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a00000000020000000000106600000001000020000000046f3ca29866b0c460ddd618ba35ee712ef2ad72fa3d6ca48de19577023ac491000000000e80000000020000200000000790d10b9108509b1686a25a55ebbeead3804543e095f8a168548c15039d920110000000c441666f6797d8933eb493320e01e1c6400000005ab322576329cb6ab211ab6b28219f59cdbbc2e6a0d8c0c909748f17e195b938e9f11b4029301dc0344f2833168c08c2864c38ab9c778f1386a1d2a36625c913	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31284097"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "905715248"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "498708781"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 3b57edeb3942dd01	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "882121622"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\User Preferences	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2928	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
2928	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
6036	svcr.exe
6036	svcr.exe
4268	svcr.exe
4268	svcr.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6036	svcr.exe
Token: SeDebugPrivilege	4268	svcr.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1264	IEXPLORE.EXE
1264	IEXPLORE.EXE
1264	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1264	IEXPLORE.EXE
1264	IEXPLORE.EXE
1788	IEXPLORE.EXE
1788	IEXPLORE.EXE
1264	IEXPLORE.EXE
1264	IEXPLORE.EXE
1264	IEXPLORE.EXE
1264	IEXPLORE.EXE
5728	IEXPLORE.EXE
5728	IEXPLORE.EXE
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 968	2928	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	88
PID 968 wrote to memory of 1264	968	IEXPLORE.EXE	89
PID 1264 wrote to memory of 1788	1264	IEXPLORE.EXE	91
PID 6036 wrote to memory of 5140	6036	svcr.exe	94
PID 5140 wrote to memory of 2312	5140	IEXPLORE.EXE	95
PID 2928 wrote to memory of 4268	2928	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	96
PID 1264 wrote to memory of 5728	1264	IEXPLORE.EXE	97
PID 4268 wrote to memory of 5164	4268	svcr.exe	98
PID 5164 wrote to memory of 5612	5164	IEXPLORE.EXE	99
PID 6036 wrote to memory of 5728	6036	svcr.exe	97
PID 6036 wrote to memory of 5728	6036	svcr.exe	97
PID 4268 wrote to memory of 5612	4268	svcr.exe	99
PID 4268 wrote to memory of 5612	4268	svcr.exe	99
PID 1264 wrote to memory of 1240	1264	IEXPLORE.EXE	100

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1264 CREDAT:17410 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1788
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1264 CREDAT:17414 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:5728
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1264 CREDAT:82946 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1240
- C:\Windows\svcr.exe
  "C:\Windows\svcr.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5164
  - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      4⤵
      Modifies Internet Explorer settings
      PID:5612

C:\Windows\svcr.exe
C:\Windows\svcr.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5140
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
    3⤵
    - Modifies Internet Explorer settings
    PID:2312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 94deecb8b3c9a16f48b404872478dc3c8c8aad2e5a5013615effcf6d732f7e8b
MD5 f232fd89dc85e8a72a0ec6ae3b4201cf
SHA1 d6bde8e11231e4cc77ccb823bd7217248a8d182a
SHA512 2ef5fe5ca0b58731631d7b0c4c47fb12a531710a8f5568dd149d42dade296c31d637d73881dc352f7fb7ee45d605bf093cb67e469635f96b8d050169d5492ffe
TLSH
T166F0D442415DF0B15E91A4EC225E6D772920F17704D8D501F37D46D444A53EB8F45428
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 c1e6de89f0a7a61d2ef8be6a29ef0ec86230cfe7ac0dec9c90808b737daa04ac
MD5 60df7319ebddec8edd954b851fa453cb
SHA1 435d25500df4f334f47e423f67932629eee93ef3
SHA512 39f95eb601e407fd1d04817c10b16cdb52aab07a585079ecec967bb80a251758bd4ddbd5689f26160cc5696bd749652a4cb2a1059ccdea7e153aa5ffea25fdd1
TLSH
T1CDE0202411FE411EF5F5EC768FDAB5259969F136141992B82AD5AB0CB702A409C0292D
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DV9ET3T5\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicon[1].ico

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FB6DDX4X\favicon[1].ico
Size 4KB
SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
MD5 da597791be3b6e732f0bc8b20e38ee62
SHA1 1125c45d285c360542027d7554a5c442288974de
SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
TLSH
T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svcr.exe

Path C:\Windows\svcr.exe
Size 219KB
SHA256 3c9342566b7dc5d9f104ce28501d688665c3085366e4abe47446932adeba7e81
MD5 3eb15c90583a61d4f643f99f7fe168cf
SHA1 c13ae1f565f6eb76a005fa881629a73d5a85485c
SHA512 8dcbfead73dd5712d31258f5c15a816c55a049889ecbe793404a718f60804df1dd05f622f3e4d1ba617ee7d0d388f15f39d2d9c3784e152fc8415d6f0d8e8567
SSDEEP 6144:IWWYSjuoCrfs22LkJcu+Txc5snyUFWgH7u:dWYSjFCp+TxOGFWgbu
TLSH
T1272402506C675533DE9E3071C6865EC4D4AE14A33752E82FCFA35939983A809EDAE02F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2928-0-0x0000000000400000-0x00000000007CF000-memory.dmp

Download

memory/2928-1-0x00000000027A0000-0x0000000002890000-memory.dmp

Download

memory/2928-16-0x00000000027A0000-0x0000000002890000-memory.dmp

Download

memory/2928-15-0x0000000000400000-0x00000000007CF000-memory.dmp

Download

memory/4268-39-0x00000000026D0000-0x00000000027C0000-memory.dmp

Download

memory/4268-29-0x0000000010410000-0x000000001042E000-memory.dmp

Download

memory/4268-30-0x0000000010410000-0x000000001042E000-memory.dmp

Download

memory/4268-38-0x0000000000400000-0x00000000007CF000-memory.dmp

Download

memory/4268-14-0x0000000000400000-0x00000000007CF000-memory.dmp

Download

memory/4268-17-0x00000000026D0000-0x00000000027C0000-memory.dmp

Download

memory/6036-19-0x0000000010410000-0x000000001042E000-memory.dmp

Download

memory/6036-28-0x0000000002720000-0x0000000002810000-memory.dmp

Download

memory/6036-27-0x0000000000400000-0x00000000007CF000-memory.dmp

Download

memory/6036-18-0x0000000010410000-0x000000001042E000-memory.dmp

Download

memory/6036-11-0x0000000002720000-0x0000000002810000-memory.dmp

Download

memory/6036-10-0x0000000000400000-0x00000000007CF000-memory.dmp

Download