Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 03:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_(LimeWireWin-4.18.8) [1_1] - _LimeWireWin-4.18.8.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_(LimeWireWin-4.18.8) [1_1] - _LimeWireWin-4.18.8.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target jaffacakes118_(LimeWireWin-4.18.8) [1_1] - _LimeWireWin-4.18.8.exe
- Size 7.5MB
- Sample260910-ebyrgswfkg
- SHA256 8a653e235d769a4d96eb53336e56c527ff5b79da3733647e3f36db1287fc03ac
- MD5 ac0e9fbd0583e7ba124426ecbfe9d1c8
- SHA1 2a28a66fefcd9c8ca8b08e646ecadea79b2b6f49
- SHA512 c1243c92a9969c3bc81bc6726fa0c7a74596dcdfa7ba1c772cc7420f34bb20d9619bce2ee7706bad914c7662669e577cf3004fd0f59ea824290d95edcbca8531
- SSDEEP 196608:gwFRrh0g3UPK39aHz3KwGTE+qkJmMiGKrxUFxLM:xrhbwT3KtTpqIHiG3LM
- TLSH T1EB76331CFB4F007DD8C30138748E6EEED9746E98EF661266A7890ED45C71EC1E60876A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation jaffacakes118_(LimeWireWin-4.18.8) [1_1] - _LimeWireWin-4.18.8.exe Key value queried \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation rinst.exe - Executes dropped EXE 5 IoCs
pid Process 2432 rinst.exe 4788 LimeWireWin-4.18.8.exe 1440 test.exe 2500 EULA.exe 2220 test.exe - Loads dropped DLL 7 IoCs
pid Process 1440 test.exe 2500 EULA.exe 1440 test.exe 1440 test.exe 3384 jaffacakes118_(LimeWireWin-4.18.8) [1_1] - _LimeWireWin-4.18.8.exe 3384 jaffacakes118_(LimeWireWin-4.18.8) [1_1] - _LimeWireWin-4.18.8.exe 3384 jaffacakes118_(LimeWireWin-4.18.8) [1_1] - _LimeWireWin-4.18.8.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" LimeWireWin-4.18.8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\test = "C:\\Windows\\SysWOW64\\test.exe" test.exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\pk.bin test.exe File created C:\Windows\SysWOW64\pk.bin rinst.exe File created C:\Windows\SysWOW64\test.exe rinst.exe File created C:\Windows\SysWOW64\testhk.dll rinst.exe File created C:\Windows\SysWOW64\kw.dat rinst.exe File created C:\Windows\SysWOW64\inst.dat rinst.exe File created C:\Windows\SysWOW64\rinst.exe rinst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language test.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_(LimeWireWin-4.18.8) [1_1] - _LimeWireWin-4.18.8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rinst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LimeWireWin-4.18.8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language test.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EULA.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2432 rinst.exe 2432 rinst.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1440 test.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 1440 test.exe 2500 EULA.exe 1440 test.exe 2220 test.exe 1440 test.exe 1440 test.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3384 wrote to memory of 2432 3384 jaffacakes118_(LimeWireWin-4.18.8) [1_1] - _LimeWireWin-4.18.8.exe 86 PID 2432 wrote to memory of 4788 2432 rinst.exe 87 PID 2432 wrote to memory of 1440 2432 rinst.exe 88 PID 4788 wrote to memory of 2500 4788 LimeWireWin-4.18.8.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_(LimeWireWin-4.18.8) [1_1] - _LimeWireWin-4.18.8.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_(LimeWireWin-4.18.8) [1_1] - _LimeWireWin-4.18.8.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\LimeWireWin-4.18.8.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\LimeWireWin-4.18.8.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EULA.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EULA.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2500
-
-
-
C:\Windows\SysWOW64\test.exeC:\Windows\system32\test.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1440
-
-
-
C:\Windows\SysWOW64\test.exeC:\Windows\SysWOW64\test.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2220
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EULA.exe
- Size 216KB
- SHA256 d9af86f90a2a260a27386c238304a37b23a802ae3d51a0b7bb72d9ba625120bb
- MD5 8f5d9861f2bfbc225565cdd2f1d39b5b
- SHA1 6a38e7e082b749c2754a049c69f2a747ae4c6923
- SHA512 c6fde1d62adb054683004a5f56c168f88bc194c45cdd003bd1550f7a27a296228cacb15392d95984f97db86744e3bbead247a3d6ccd2ddb088a6ed1afb5f039d
- SSDEEP 3072:JcSXaCJVnv6Dtrpj9+G7V1fFz8C+CUNuc1uQnHP2x8H6J3DGqmEK2:JcSXaCJ56P9fBVf+C5euUHH6J+2
- TLSH T1C724F3A7D792843FFCDF067063C848807E3BABA225FBF756A65603C7195414C096E26B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\LimeWireWin-4.18.8.exe
- Size 7.2MB
- SHA256 62cca610f34b851a586372a847068c247a7d98e3e46de36735ff147ab9558192
- MD5 10c1b72c84ef364140be779597f4154f
- SHA1 ff62d6bd1180cad2833d78da7879713bfc0838c4
- SHA512 a067bcca66d0a988d1bdcacf90ef412a9ab4ef2de7dc160dafd7e8b2103423f3123840a784d7c04bda67d3f1588e1dc8c75af16e6e098701bb2df8bf2d0ad321
- SSDEEP 98304:pXEnPmnKqfYEF57jdPu1FaVDcGsqIbZugGle8njitAB15H/ygRNWYO2gV0MRIn5p:pXwhkF53WFiAhqiZcrnjiagG/ZhMRIj
- TLSH T12576331143D5B02BE4C0D73847E1A339AF3814E55B7A810A9628ACEC6C6E4D5A57E3FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\inst.dat
- Size 1KB
- SHA256 f50cc87f18341ea0161fc0378b5e789a41dcc059785b83b0f9fd45b9c3db43f2
- MD5 0e7805301e6b942c50303d9af3fcd7c3
- SHA1 1a13a7a56c4c7412d0b19ac24b06d3f844f6aea4
- SHA512 002589f7acf48186ebfd92cdb3c77e659b000393a0a331059a118748a43916458ded40c9a1e7890f8fc9e7893123a4d808c7d99ba26cc967253904d0102838b3
- TLSH T12E21B6421BEA035AE9B3AD70BCF4C92208243834F975C74C82406D5D0867759AC64F11
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\kw.dat
- Size 72B
- SHA256 a22f4e4471c999985677155d54ef313ca4bc6036c8b89ed6aab93f0ba2652876
- MD5 d95b3d9c7f39571bc69debbe5d5eabf1
- SHA1 ddf5b477e98a5299853b902a08094300e7253f17
- SHA512 43637b4c0312ae9d860662c1857ba12ce2ce390efb3dfb6ea7bdf6aa4273c18de85bbd71bc9bde57d1ae7c86dfc2cb0a65e8e4c5b06e906c87321ce86806473c
- TLSH T1F3A0020410BC0CDE2081619C2E2F4950EC87333900C114C588128CC524905FC9078E74
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\pk.bin
- Size 7KB
- SHA256 ef18d204bf2751716287b2b4f22c10bea80691cb94133e60a9e97c52cbd59c73
- MD5 ebd0becc638f774b08066901663990ae
- SHA1 6b0a3b6472fa0b9055eb30908fd00705b8546b7e
- SHA512 d27c2cdda55b50c241fe3e93fccc063e2a570b9ae4c17d3189bdfa0de2b5523e83eeae790d9ec80a43dc2d2de6859ded792244cbe9cd9865266d884e16262bbb
- SSDEEP 12:XJi8F/zzecl5Lm9fSbSLsp7rx+S+QAf5U0TcWsqRul9SOkR9h:88FnLl5Lm9DIp7rWQACjqRueFR7
- TLSH T11AF1A002B83F33828ACEDCB2A1D5328C9D38826503D934F56926D71E15B28FB6DC1A1D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe
- Size 22KB
- SHA256 98d257f639ee9df968f77b1f66c78230d07d86e58a7ddf0d306a24af3873dc5b
- MD5 9a00d512f9e1464ad793702cf2b1eda0
- SHA1 39a47a90cd3dd132dbab9f5052dda38dbd7c63f6
- SHA512 18604f20351db1d418f48f2eb023be07588754b428b5d6abb0a7c40d6bf174ce7dcab2ae6e06f22585e12f1bfdb6e408b17bf20e2a7ba137620002ac04b8b4ba
- SSDEEP 384:c3PqIGR1uEtfWlXdbvoht0zsQHmr246v1hLqsHWuTqvhwp:aqZv3tfEbgIzsQHs6v1hLqQ9q
- TLSH T15FA2A4563FE70735F3B3CB306574EB12896AB9A2E853CB4DC4D21F090523A5699F0E26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe
- Size 408KB
- SHA256 14ffd7caaad32dc5817ecc47efd9044021804ff45d45e7f7b20f35278f453b5f
- MD5 5ca652cf9dd0149c774948228f8aefd1
- SHA1 86ba117b337495cbb2ab1821262d996af4d02de8
- SHA512 e792843e268e215daa050dda0fdd3f7406bdb0ee632b864059cf92dcc068bdd90c4466e57707968d62d9405cbcf4064ad4f8540bdbff0edaa1e6f6960f0794b5
- SSDEEP 6144:mSHte6rMTxNIOf+B3ak9GNpXKbm5WKkNsveV3yY1/IpQ+ABW9l1LcdE2:mYA6rMTx2aKG/XOm5FjG1AWMmh
- TLSH T1C2945A015E7C98E765DB226E244482587D9FABFA2984D1F388E7ACCC359D1F8501CE2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\testhk.dll
- Size 21KB
- SHA256 7f3496f6a694fe04f258552aa9e497139adf8f1104e49a7c6dd538e004a08311
- MD5 86fa5da207c167119faf823e9ba3ce70
- SHA1 204b209426bd674e55ef31112c8f796abe5f8be5
- SHA512 35e85719eb4f997a29120ce1c3d31c690f18b5edb165f71ca75c47517155ecf6e039551eb4efc4f8308804b227bedffb86e65ed4506728aed039895c92b7ad38
- SSDEEP 384:KBbuVk/WCAZxyhDJN6RJwO1+7399/SPO8v6FDxpPA2rFKlkO:KBmk/WCWxyhDJNYJwOaz/wNvS02ZKlx
- TLSH T194A22A925D38A1AB12E2554D2CC14B6D7CB83466ED10AEEE47B69AFC33FEC36515C00E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\uimgr90210update.tmp
- Size 144KB
- SHA256 ebc72381696fd70984941556c9ad8b9b32f22fa69e272849c5881c04a4e870fb
- MD5 606ca76222b01aa3dc4bfc747d77a384
- SHA1 80a3b80ac0ce6a2b12131b3a57024725833c646c
- SHA512 1c0f9b2c5396b91d1b985d49bd9e2ce851b9689e99bec93629e6c120f2481a470f50be5ef9d9fa44c988da0394cf2492a523a850d80077acd0aa17072c9b8406
- SSDEEP 1536:2Wn6NUkTy5xhDVgn6nZqbrNKe1W98LiUKSO4BcpVienTqk1k4zLTbBsqrn4W1Rop:2W63G5xJFn83nLiC+tT2M4Ht16Ocu
- TLSH T11DE3AE0131D4C0F7D4A6027F401AC7254BA7B894A9AE5DC77FCD0AD96B296A3DB3A343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\kw.dat
- Size 72B
- SHA256 712f75eb4662493a2bbf7d41ef447130aef126f422dd9e72f466003bdc068095
- MD5 6339fd0c1b32d0164313af082e66064d
- SHA1 102ccfdb63cf07c2a1c9115bf8cd16c56fa1f813
- SHA512 593b7a33835f81b8c0d2d06563659f925dcdf795c22c37c9e9cec5a18edd7ecefa909f423d23e3f7889dd5055ecdb151d3c50306271037ba506a2c9e5c4eef1d
- TLSH T1BBA002673DE07104D2F31E103E3520540F3E3E560510C06C64E1438F48F18105E1532B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\pk.bin
- Size 7KB
- SHA256 d63b89c5c2377621b355b3b6cb3222420197187f7b7152a4624d3c2849893ab5
- MD5 53eaddb2d4272ed387359a9b83e0a278
- SHA1 de8add93df223cc6ef54e3cd61cde338c02cf32f
- SHA512 fd415012c3da8ca3a5c66c5748e6260408f450a09c62c5c79926bf8208faf925c52d41db5a51552bfd2b846d645ba54a9fa16c0e2ca2c355763c8d3bb4dc50e5
- SSDEEP 12:Lw0UcKV2BBVgppZlVOkTpZt7HPKEhWqgnD1khZ+YSH2x3:LY4UCkFvv2tD13YtB
- TLSH T1EBF189EEE40AEC23BE90588A345288A0F51CEF1020178E61C264590DC247B697BCDDB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\test.exe
- Size 408KB
- SHA256 cd06f57e2e2956c634f851eb92666e9e24557fffbfcd098686e3d7fe03d8ffed
- MD5 a635bc1492e4c39ef47ed617d3dfe491
- SHA1 353ae5d543aee4bd2084798308a82361336b34fb
- SHA512 e152eaaebc4a6a48d32ed2382e048f171d35200d1654cfb241f57612b655e921b8645e700f011d3638fda4bbc7f50e90ebdc24398664a9e553540b15a006b226
- SSDEEP 12288:IIsNvzk/CGbZIuTqJxRGRtjNX0zKt8+rwnb:IIsNvz2CuTWGRt53tw
- TLSH T11E945C017BFB4826E5B21A31DAB617B2B9F9BB624C37CE0B5340997CD931E11DA10B35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\testhk.dll
- Size 21KB
- SHA256 0ee6154256e55de7d451e729c590f5bbf65479503099c3dfeaa10deac6fe4901
- MD5 a11068817ba83d7b8c61a5c53c5a72ab
- SHA1 cf4685ae095d5b1e92062c9d299cf9d250b6bab2
- SHA512 a5ef2ec37eaf688c1fa926349227d25de1c5568c5630e56f8e5e3104ae6ee45275de8599d33d164cd2fc7c5b5dd853433e4228ff553d83228ae3f925446e9bae
- SSDEEP 384:Hm3aDEM3BjSZiAtu3Zq5iwd+6I4rt64E53K:+aQMAZiKupmiB4rt
- TLSH T1B6A24BE1675416F1E5782C3031ABAE3B123EE77505609997CAA7EC744D32289BE38353
- MD5 SHA1 SHA512 SSDEEP TLSH