Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/10/2026, 04:38
Behavioral task
behavioral1
Sample
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe
- Size 11KB
- Sample261014-e9vgqaws5j
- SHA256 5b679e851e9b8a85c57a91e01a2fbb938b0fafb9ca2ea302ded42b588747b236
- MD5 b900ee75431531e02d0e9b510437e785
- SHA1 223f12c48a3c54f367313a0b3536cebea2b82af5
- SHA512 acb96940df538fac6d88c883b25985ad13d88c35d2ba8ce0fbc74975bbbb82c3cd6330b08d4a4f1fa502785554bfc74b17192cbbb59e6f86ab08c816be8b661c
- SSDEEP 192:x9RmoQ528G4iN0Rbo7hQEMYwZ0Rr9ZCspE+TMwrRmK+vhOrT:xTmF2b4iN0po7GEDwKEeM4mu
- TLSH T18C426C8B2B6C24EAEDD24F30D1D7D6178D3477241FACD59E18B081D93D573602B2AA0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/3648-0-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/3648-1-0x0000000000400000-0x0000000000408000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000592c972055b30f42897d4dd4c712190b0000000002000000000010660000000100002000000095c08a0491ec19b38575ebc30e975e7e70d357f046101408d55f7b74d2f610f1000000000e800000000200002000000027d03428d1ee5112edee7ac53fbfe9e4d24f20324b234982225c96a8c441b31420000000d63aeddcba4ba094c8ed9b38f443ed51387dd7e6a91d13037ff73e2c246f7294400000000e0d191d960341a63b36e6def91eafc473e63361cb0626bf16461251da19f7b2312abeabc81ab9bd7c2f814594927c2b2dc245142e2dd4a167f9d2a4d650b9bd iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c05362609e5bdd01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07f69609e5bdd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "498717709" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31284117" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000592c972055b30f42897d4dd4c712190b000000000200000000001066000000010000200000001ec24a8f6188ba48d9ee58bc116fbb748ff25b679251c5fac13cab176db323d3000000000e80000000020000200000009087d193b256a5158257162e2ac30de658bc808e80c40fc9809c7d2c7da7742320000000955985f5ab481c6983cb685a1a6bf05f5fa157caa881f937aa140a9e1eba0f3d400000008ff42c53eb66f301311da8df823919c11b9c43e4390f16038ffd7cd23e3b169d457895babec1ff7b4586798571bde1cb9aaeb1d1c4a91fd113c48ec9635ba16f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2962B3BD-C789-11F1-9982-7E5B85AE0DE4} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4260677605" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31284117" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4264896247" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4796 iexplore.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3648 jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe 4796 iexplore.exe 4796 iexplore.exe 4632 IEXPLORE.EXE 4632 IEXPLORE.EXE 4632 IEXPLORE.EXE 4632 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3648 wrote to memory of 4796 3648 jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe 86 PID 4796 wrote to memory of 4632 4796 iexplore.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "http://ads.regiedepub.com/cgi-bin/advert/getads?did=1075&tohto=titi&soso=sisih"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4796 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4632
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 94deecb8b3c9a16f48b404872478dc3c8c8aad2e5a5013615effcf6d732f7e8b
- MD5 f232fd89dc85e8a72a0ec6ae3b4201cf
- SHA1 d6bde8e11231e4cc77ccb823bd7217248a8d182a
- SHA512 2ef5fe5ca0b58731631d7b0c4c47fb12a531710a8f5568dd149d42dade296c31d637d73881dc352f7fb7ee45d605bf093cb67e469635f96b8d050169d5492ffe
- TLSH T166F0D442415DF0B15E91A4EC225E6D772920F17704D8D501F37D46D444A53EB8F45428
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 3e4d0d648350ab39ca33b2f346291d55b530e8e02e7f7b39eeeb0925e8fc5bac
- MD5 49bd2ffe00e4239bb39d2fbb394d3991
- SHA1 45cae377ee4c2d41c8cadf4217bf630e627a2168
- SHA512 207d4d2b8d73c1369831bd230a31f1f6b6ed535cb2f20442441d2e65f20c8c994524fca581160b259ee3e3185540466ba4c7054ab84f5ceea617078f6d84d810
- TLSH T18DE0C02411FA011EE4F4F8768FC97521885AF032141892B83DD46B0CB7036409C03A2D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IG9UOCZZ\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH