d7f659d8faf1787f6014c8275704fc1cd52b9937af4ec3eba374c12dfbf51bbc

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_d7f659d8faf1787f6014c8275704fc1cd52b9937af4ec3eba374c12dfbf51bbc.exe
Size 2.0MB
Sample260930-pksa6sty8k
SHA256 d7f659d8faf1787f6014c8275704fc1cd52b9937af4ec3eba374c12dfbf51bbc
MD5 4e261409d310509ae36132a145effcc2
SHA1 31c54d8a0fefa666fad5f30881482643a0ff33ac
SHA512 af1efd259a7b46be6474d7158df4410615bd26408089226ddc909eff429845067710031e1315308bc367f9ad9d7e1114bd1dcebe1d790c572409d5ce3cec369e
SSDEEP 24576:lmYkdGMRohsoA8/xUByJDKTD09m5ftthpfVXal9FTzvvMzvvby4:fMOk6FAD0I5fttbdal9FTzvvMzvvp
TLSH
T10F953813B6B1D037D16601F4CD7782FDA161AE65CD38480BA3D07F68BA7AB436C26B19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_d7f659d8faf1787f6014c8275704fc1cd52b9937af4ec3eba374c12dfbf51bbc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_d7f659d8faf1787f6014c8275704fc1cd52b9937af4ec3eba374c12dfbf51bbc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_d7f659d8faf1787f6014c8275704fc1cd52b9937af4ec3eba374c12dfbf51bbc.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main	jaffacakes118_d7f659d8faf1787f6014c8275704fc1cd52b9937af4ec3eba374c12dfbf51bbc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	jaffacakes118_d7f659d8faf1787f6014c8275704fc1cd52b9937af4ec3eba374c12dfbf51bbc.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	jaffacakes118_d7f659d8faf1787f6014c8275704fc1cd52b9937af4ec3eba374c12dfbf51bbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	jaffacakes118_d7f659d8faf1787f6014c8275704fc1cd52b9937af4ec3eba374c12dfbf51bbc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1624	jaffacakes118_d7f659d8faf1787f6014c8275704fc1cd52b9937af4ec3eba374c12dfbf51bbc.exe
1624	jaffacakes118_d7f659d8faf1787f6014c8275704fc1cd52b9937af4ec3eba374c12dfbf51bbc.exe
1624	jaffacakes118_d7f659d8faf1787f6014c8275704fc1cd52b9937af4ec3eba374c12dfbf51bbc.exe
1624	jaffacakes118_d7f659d8faf1787f6014c8275704fc1cd52b9937af4ec3eba374c12dfbf51bbc.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d7f659d8faf1787f6014c8275704fc1cd52b9937af4ec3eba374c12dfbf51bbc.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d7f659d8faf1787f6014c8275704fc1cd52b9937af4ec3eba374c12dfbf51bbc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

downloader_logo[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WLCSD876\downloader_logo[1].htm
Size 114B
SHA256 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
MD5 e89f75f918dbdcee28604d4e09dd71d7
SHA1 f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA512 8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0
TLSH
T1EEB092DDBC61E48018E535511EA3B60D146A22EBB9018B4018C00836A96035F8D0AAC5
MD5 SHA1 SHA512 TLSH

Submit Download

jaffacakes118_d7f659d8faf1787f6014c8275704fc1cd52b9937af4ec3eba374c12dfbf51bbc.htm

Path C:\Users\Admin\AppData\Roaming\GetRightToGo\jaffacakes118_d7f659d8faf1787f6014c8275704fc1cd52b9937af4ec3eba374c12dfbf51bbc.htm
Size 87KB
SHA256 ca6005b88259d61bfc9943b1236cd4f6f12833f3134a3c1553545247d95aca2d
MD5 2290e78ddaffaa73838e9a67d679cbc7
SHA1 5e2583a2c5bad107c82cab2a495d559e1385ae41
SHA512 a2c6ae503b264e30925c685efb6389175138fb809989d5e4c61e62345662c0d7a6e0de57c6a8f883209c7bf613c6be3fb4ca2031876d562271c8b111ad338abc
SSDEEP 1536:REGyFGTDphMWPQpJ0G/UFmOgrt8/BeXdyIg99CO+hbjai8Zfo1sXmsKD52X4Qe7w:I8TaIFvpvEMuXDXzvvbyEs
TLSH
T168930AD9B2D6716387A731B864BF420BB03598AAB84C8850F068D9F5BE74E44407BF7D
MD5 SHA1 SHA512 SSDEEP TLSH