Overview

overview

6

Static

static

1

jaffacakes...up.exe

windows10-2004-x64

6

jaffacakes...up.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 03:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_Everything-1.5.0.1391a.x64-Setup.exe
  • Size 1.7MB
  • Sample260910-eb4bzayvfs
  • SHA256 08712d7f9e87cb8181664b58471ab4addde4396566acc15b57b6c7de24a0425a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 4 IoCs
  • Executes dropped EXE 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Everything-1.5.0.1391a.x64-Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Everything-1.5.0.1391a.x64-Setup.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:560
    • C:\Users\Admin\AppData\Local\Temp\esw5436.tmp\Everything64.exe
      "C:\Users\Admin\AppData\Local\Temp\esw5436.tmp\Everything64.exe" -setup
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5008
      • C:\Users\Admin\AppData\Local\Temp\esw5436.tmp\Everything64.exe
        "C:\Users\Admin\AppData\Local\Temp\esw5436.tmp\Everything64.exe" -install "C:\Program Files\Everything 1.5a" -install-options " -no-app-data -install-run-on-system-startup -uninstall-service -disable-index-as-admin -enable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -uninstall-efu-association -save-install-options 0"
        3⤵
        • Checks computer location settings
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4148
        • C:\Program Files\Everything 1.5a\Everything64.exe
          "C:\Program Files\Everything 1.5a\Everything64.exe" -no-app-data -install-run-on-system-startup -uninstall-service -disable-index-as-admin -enable-run-as-admin -uninstall-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -uninstall-efu-association -save-install-options 0
          4⤵
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:3400
      • C:\Program Files\Everything 1.5a\Everything64.exe
        "C:\Program Files\Everything 1.5a\Everything64.exe" -disable-update-notification -uninstall-quick-launch-shortcut -no-choose-volumes
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3688
      • C:\Program Files\Everything 1.5a\Everything64.exe
        "C:\Program Files\Everything 1.5a\Everything64.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:968
  • C:\Program Files\Everything 1.5a\Everything64.exe
    "C:\Program Files\Everything 1.5a\Everything64.exe" -startup
    1⤵
    • Enumerates connected drives
    • Executes dropped EXE
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:736

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Everything-1.5a.ini
        • Path C:\Program Files\Everything 1.5a\Everything-1.5a.ini
        • Size 108KB
        • SHA256 c49427f3ceff6897a87e534f33c99245b0a2e19f06e6c9d9158ccf9b093172b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Everything 1.5a.lnk
        • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Everything 1.5a.lnk
        • Size 1KB
        • SHA256 ffbf003e61929eae7a0a7f6b85a62701aaa6c15e3472fdf046e4d0dfbb2129e7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Everything64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\esw5436.tmp\Everything64.exe
        • Size 5.4MB
        • SHA256 bdacc22ca03f5cee95fd8d3abf2bda3b5206b6b5ec086234a01cb562b21e58df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Everything 1.5a.lnk
        • Path C:\Users\Public\Desktop\Everything 1.5a.lnk
        • Size 1KB
        • SHA256 97a0e129244b5323869e365bbbf65935f8f0ed682c55f139638eb68da8223bc0
        • MD5 SHA1 SHA512 TLSH
        Submit Download