8a653e235d769a4d96eb53336e56c527ff5b79da3733647e3f36db1287fc03ac

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_(LimeWireWin-4.18.8) [1_1] - _LimeWireWin-4.18.8.exe
Size 7.5MB
Sample260910-ebyrgswfkg
SHA256 8a653e235d769a4d96eb53336e56c527ff5b79da3733647e3f36db1287fc03ac
MD5 ac0e9fbd0583e7ba124426ecbfe9d1c8
SHA1 2a28a66fefcd9c8ca8b08e646ecadea79b2b6f49
SHA512 c1243c92a9969c3bc81bc6726fa0c7a74596dcdfa7ba1c772cc7420f34bb20d9619bce2ee7706bad914c7662669e577cf3004fd0f59ea824290d95edcbca8531
SSDEEP 196608:gwFRrh0g3UPK39aHz3KwGTE+qkJmMiGKrxUFxLM:xrhbwT3KtTpqIHiG3LM
TLSH
T1EB76331CFB4F007DD8C30138748E6EEED9746E98EF661266A7890ED45C71EC1E60876A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
3688	rinst.exe
4344	LimeWireWin-4.18.8.exe
2340	test.exe
5652	EULA.exe
2752	test.exe

Loads dropped DLL 7 IoCs

pid	Process
2340	test.exe
5652	EULA.exe
2340	test.exe
2340	test.exe
4644	jaffacakes118_(LimeWireWin-4.18.8) [1_1] - _LimeWireWin-4.18.8.exe
4644	jaffacakes118_(LimeWireWin-4.18.8) [1_1] - _LimeWireWin-4.18.8.exe
4644	jaffacakes118_(LimeWireWin-4.18.8) [1_1] - _LimeWireWin-4.18.8.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	LimeWireWin-4.18.8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\test = "C:\\Windows\\SysWOW64\\test.exe"	test.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\pk.bin	test.exe
File created	C:\Windows\SysWOW64\pk.bin	rinst.exe
File created	C:\Windows\SysWOW64\test.exe	rinst.exe
File created	C:\Windows\SysWOW64\testhk.dll	rinst.exe
File created	C:\Windows\SysWOW64\kw.dat	rinst.exe
File created	C:\Windows\SysWOW64\inst.dat	rinst.exe
File created	C:\Windows\SysWOW64\rinst.exe	rinst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_(LimeWireWin-4.18.8) [1_1] - _LimeWireWin-4.18.8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rinst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LimeWireWin-4.18.8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EULA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3688	rinst.exe
3688	rinst.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2340	test.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
2340	test.exe
5652	EULA.exe
2752	test.exe
2340	test.exe
2340	test.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 3688	4644	jaffacakes118_(LimeWireWin-4.18.8) [1_1] - _LimeWireWin-4.18.8.exe	89
PID 3688 wrote to memory of 4344	3688	rinst.exe	90
PID 3688 wrote to memory of 2340	3688	rinst.exe	91
PID 4344 wrote to memory of 5652	4344	LimeWireWin-4.18.8.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_(LimeWireWin-4.18.8) [1_1] - _LimeWireWin-4.18.8.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_(LimeWireWin-4.18.8) [1_1] - _LimeWireWin-4.18.8.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\LimeWireWin-4.18.8.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\LimeWireWin-4.18.8.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EULA.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EULA.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5652
- - C:\Windows\SysWOW64\test.exe
    C:\Windows\system32\test.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:2340

C:\Windows\SysWOW64\test.exe
C:\Windows\SysWOW64\test.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EULA.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EULA.exe
Size 216KB
SHA256 d9af86f90a2a260a27386c238304a37b23a802ae3d51a0b7bb72d9ba625120bb
MD5 8f5d9861f2bfbc225565cdd2f1d39b5b
SHA1 6a38e7e082b749c2754a049c69f2a747ae4c6923
SHA512 c6fde1d62adb054683004a5f56c168f88bc194c45cdd003bd1550f7a27a296228cacb15392d95984f97db86744e3bbead247a3d6ccd2ddb088a6ed1afb5f039d
SSDEEP 3072:JcSXaCJVnv6Dtrpj9+G7V1fFz8C+CUNuc1uQnHP2x8H6J3DGqmEK2:JcSXaCJ56P9fBVf+C5euUHH6J+2
TLSH
T1C724F3A7D792843FFCDF067063C848807E3BABA225FBF756A65603C7195414C096E26B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimeWireWin-4.18.8.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\LimeWireWin-4.18.8.exe
Size 7.2MB
SHA256 62cca610f34b851a586372a847068c247a7d98e3e46de36735ff147ab9558192
MD5 10c1b72c84ef364140be779597f4154f
SHA1 ff62d6bd1180cad2833d78da7879713bfc0838c4
SHA512 a067bcca66d0a988d1bdcacf90ef412a9ab4ef2de7dc160dafd7e8b2103423f3123840a784d7c04bda67d3f1588e1dc8c75af16e6e098701bb2df8bf2d0ad321
SSDEEP 98304:pXEnPmnKqfYEF57jdPu1FaVDcGsqIbZugGle8njitAB15H/ygRNWYO2gV0MRIn5p:pXwhkF53WFiAhqiZcrnjiagG/ZhMRIj
TLSH
T12576331143D5B02BE4C0D73847E1A339AF3814E55B7A810A9628ACEC6C6E4D5A57E3FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inst.dat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\inst.dat
Size 1KB
SHA256 f50cc87f18341ea0161fc0378b5e789a41dcc059785b83b0f9fd45b9c3db43f2
MD5 0e7805301e6b942c50303d9af3fcd7c3
SHA1 1a13a7a56c4c7412d0b19ac24b06d3f844f6aea4
SHA512 002589f7acf48186ebfd92cdb3c77e659b000393a0a331059a118748a43916458ded40c9a1e7890f8fc9e7893123a4d808c7d99ba26cc967253904d0102838b3
TLSH
T12E21B6421BEA035AE9B3AD70BCF4C92208243834F975C74C82406D5D0867759AC64F11
MD5 SHA1 SHA512 TLSH

Submit Download

kw.dat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\kw.dat
Size 72B
SHA256 a22f4e4471c999985677155d54ef313ca4bc6036c8b89ed6aab93f0ba2652876
MD5 d95b3d9c7f39571bc69debbe5d5eabf1
SHA1 ddf5b477e98a5299853b902a08094300e7253f17
SHA512 43637b4c0312ae9d860662c1857ba12ce2ce390efb3dfb6ea7bdf6aa4273c18de85bbd71bc9bde57d1ae7c86dfc2cb0a65e8e4c5b06e906c87321ce86806473c
TLSH
T1F3A0020410BC0CDE2081619C2E2F4950EC87333900C114C588128CC524905FC9078E74
MD5 SHA1 SHA512 TLSH

Submit Download

pk.bin

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\pk.bin
Size 7KB
SHA256 ef18d204bf2751716287b2b4f22c10bea80691cb94133e60a9e97c52cbd59c73
MD5 ebd0becc638f774b08066901663990ae
SHA1 6b0a3b6472fa0b9055eb30908fd00705b8546b7e
SHA512 d27c2cdda55b50c241fe3e93fccc063e2a570b9ae4c17d3189bdfa0de2b5523e83eeae790d9ec80a43dc2d2de6859ded792244cbe9cd9865266d884e16262bbb
SSDEEP 12:XJi8F/zzecl5Lm9fSbSLsp7rx+S+QAf5U0TcWsqRul9SOkR9h:88FnLl5Lm9DIp7rWQACjqRueFR7
TLSH
T11AF1A002B83F33828ACEDCB2A1D5328C9D38826503D934F56926D71E15B28FB6DC1A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rinst.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe
Size 22KB
SHA256 98d257f639ee9df968f77b1f66c78230d07d86e58a7ddf0d306a24af3873dc5b
MD5 9a00d512f9e1464ad793702cf2b1eda0
SHA1 39a47a90cd3dd132dbab9f5052dda38dbd7c63f6
SHA512 18604f20351db1d418f48f2eb023be07588754b428b5d6abb0a7c40d6bf174ce7dcab2ae6e06f22585e12f1bfdb6e408b17bf20e2a7ba137620002ac04b8b4ba
SSDEEP 384:c3PqIGR1uEtfWlXdbvoht0zsQHmr246v1hLqsHWuTqvhwp:aqZv3tfEbgIzsQHs6v1hLqQ9q
TLSH
T15FA2A4563FE70735F3B3CB306574EB12896AB9A2E853CB4DC4D21F090523A5699F0E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

test.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\test.exe
Size 408KB
SHA256 14ffd7caaad32dc5817ecc47efd9044021804ff45d45e7f7b20f35278f453b5f
MD5 5ca652cf9dd0149c774948228f8aefd1
SHA1 86ba117b337495cbb2ab1821262d996af4d02de8
SHA512 e792843e268e215daa050dda0fdd3f7406bdb0ee632b864059cf92dcc068bdd90c4466e57707968d62d9405cbcf4064ad4f8540bdbff0edaa1e6f6960f0794b5
SSDEEP 6144:mSHte6rMTxNIOf+B3ak9GNpXKbm5WKkNsveV3yY1/IpQ+ABW9l1LcdE2:mYA6rMTx2aKG/XOm5FjG1AWMmh
TLSH
T1C2945A015E7C98E765DB226E244482587D9FABFA2984D1F388E7ACCC359D1F8501CE2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

testhk.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\testhk.dll
Size 21KB
SHA256 7f3496f6a694fe04f258552aa9e497139adf8f1104e49a7c6dd538e004a08311
MD5 86fa5da207c167119faf823e9ba3ce70
SHA1 204b209426bd674e55ef31112c8f796abe5f8be5
SHA512 35e85719eb4f997a29120ce1c3d31c690f18b5edb165f71ca75c47517155ecf6e039551eb4efc4f8308804b227bedffb86e65ed4506728aed039895c92b7ad38
SSDEEP 384:KBbuVk/WCAZxyhDJN6RJwO1+7399/SPO8v6FDxpPA2rFKlkO:KBmk/WCWxyhDJNYJwOaz/wNvS02ZKlx
TLSH
T194A22A925D38A1AB12E2554D2CC14B6D7CB83466ED10AEEE47B69AFC33FEC36515C00E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uimgr90210update.tmp

Path C:\Users\Admin\AppData\Local\Temp\uimgr90210update.tmp
Size 144KB
SHA256 ebc72381696fd70984941556c9ad8b9b32f22fa69e272849c5881c04a4e870fb
MD5 606ca76222b01aa3dc4bfc747d77a384
SHA1 80a3b80ac0ce6a2b12131b3a57024725833c646c
SHA512 1c0f9b2c5396b91d1b985d49bd9e2ce851b9689e99bec93629e6c120f2481a470f50be5ef9d9fa44c988da0394cf2492a523a850d80077acd0aa17072c9b8406
SSDEEP 1536:2Wn6NUkTy5xhDVgn6nZqbrNKe1W98LiUKSO4BcpVienTqk1k4zLTbBsqrn4W1Rop:2W63G5xJFn83nLiC+tT2M4Ht16Ocu
TLSH
T11DE3AE0131D4C0F7D4A6027F401AC7254BA7B894A9AE5DC77FCD0AD96B296A3DB3A343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kw.dat

Path C:\Windows\SysWOW64\kw.dat
Size 72B
SHA256 712f75eb4662493a2bbf7d41ef447130aef126f422dd9e72f466003bdc068095
MD5 6339fd0c1b32d0164313af082e66064d
SHA1 102ccfdb63cf07c2a1c9115bf8cd16c56fa1f813
SHA512 593b7a33835f81b8c0d2d06563659f925dcdf795c22c37c9e9cec5a18edd7ecefa909f423d23e3f7889dd5055ecdb151d3c50306271037ba506a2c9e5c4eef1d
TLSH
T1BBA002673DE07104D2F31E103E3520540F3E3E560510C06C64E1438F48F18105E1532B
MD5 SHA1 SHA512 TLSH

Submit Download

pk.bin

Path C:\Windows\SysWOW64\pk.bin
Size 7KB
SHA256 d63b89c5c2377621b355b3b6cb3222420197187f7b7152a4624d3c2849893ab5
MD5 53eaddb2d4272ed387359a9b83e0a278
SHA1 de8add93df223cc6ef54e3cd61cde338c02cf32f
SHA512 fd415012c3da8ca3a5c66c5748e6260408f450a09c62c5c79926bf8208faf925c52d41db5a51552bfd2b846d645ba54a9fa16c0e2ca2c355763c8d3bb4dc50e5
SSDEEP 12:Lw0UcKV2BBVgppZlVOkTpZt7HPKEhWqgnD1khZ+YSH2x3:LY4UCkFvv2tD13YtB
TLSH
T1EBF189EEE40AEC23BE90588A345288A0F51CEF1020178E61C264590DC247B697BCDDB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

test.exe

Path C:\Windows\SysWOW64\test.exe
Size 408KB
SHA256 cd06f57e2e2956c634f851eb92666e9e24557fffbfcd098686e3d7fe03d8ffed
MD5 a635bc1492e4c39ef47ed617d3dfe491
SHA1 353ae5d543aee4bd2084798308a82361336b34fb
SHA512 e152eaaebc4a6a48d32ed2382e048f171d35200d1654cfb241f57612b655e921b8645e700f011d3638fda4bbc7f50e90ebdc24398664a9e553540b15a006b226
SSDEEP 12288:IIsNvzk/CGbZIuTqJxRGRtjNX0zKt8+rwnb:IIsNvz2CuTWGRt53tw
TLSH
T11E945C017BFB4826E5B21A31DAB617B2B9F9BB624C37CE0B5340997CD931E11DA10B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

testhk.dll

Path C:\Windows\SysWOW64\testhk.dll
Size 21KB
SHA256 0ee6154256e55de7d451e729c590f5bbf65479503099c3dfeaa10deac6fe4901
MD5 a11068817ba83d7b8c61a5c53c5a72ab
SHA1 cf4685ae095d5b1e92062c9d299cf9d250b6bab2
SHA512 a5ef2ec37eaf688c1fa926349227d25de1c5568c5630e56f8e5e3104ae6ee45275de8599d33d164cd2fc7c5b5dd853433e4228ff553d83228ae3f925446e9bae
SSDEEP 384:Hm3aDEM3BjSZiAtu3Zq5iwd+6I4rt64E53K:+aQMAZiKupmiB4rt
TLSH
T1B6A24BE1675416F1E5782C3031ABAE3B123EE77505609997CAA7EC744D32289BE38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2340-66-0x0000000004AA0000-0x0000000004AC5000-memory.dmp

Download

memory/4644-71-0x0000000000400000-0x0000000000421000-memory.dmp

Download