c6780e9c6405ab6938e8fe5ae7851fcf868a4c0e9ebd4fc9385ff999fd4ede16

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_c6780e9c6405ab6938e8fe5ae7851fcf868a4c0e9ebd4fc9385ff999fd4ede16.exe
Size 2.0MB
Sample260930-plm3vafb82
SHA256 c6780e9c6405ab6938e8fe5ae7851fcf868a4c0e9ebd4fc9385ff999fd4ede16
MD5 659c8634abe3e48a073ad84d650db879
SHA1 879ed2d0c99d97b45ce055641174a3928fcda3c5
SHA512 efea15157b8005c3e6a32e0e3c197848c8e2f7bfb69d1e77b4c0730d1df7fe67812bc5738e687a21dc840fad1cb8dbebc5478b51dbb3e9d6e6f95aef2fd29232
SSDEEP 24576:lmYkdGMRohsoA8/xUByJDKTD09m5ftthpfVXal9FTzvvMzvvby0:fMOk6FAD0I5fttbdal9FTzvvMzvvN
TLSH
T124953813B6B1D037D16601F4CD7782FDA161AE65CD38480BA3D07F68BA7AB436C26B19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_c6780e9c6405ab6938e8fe5ae7851fcf868a4c0e9ebd4fc9385ff999fd4ede16.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_c6780e9c6405ab6938e8fe5ae7851fcf868a4c0e9ebd4fc9385ff999fd4ede16.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_c6780e9c6405ab6938e8fe5ae7851fcf868a4c0e9ebd4fc9385ff999fd4ede16.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main	jaffacakes118_c6780e9c6405ab6938e8fe5ae7851fcf868a4c0e9ebd4fc9385ff999fd4ede16.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	jaffacakes118_c6780e9c6405ab6938e8fe5ae7851fcf868a4c0e9ebd4fc9385ff999fd4ede16.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	jaffacakes118_c6780e9c6405ab6938e8fe5ae7851fcf868a4c0e9ebd4fc9385ff999fd4ede16.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	jaffacakes118_c6780e9c6405ab6938e8fe5ae7851fcf868a4c0e9ebd4fc9385ff999fd4ede16.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5320	jaffacakes118_c6780e9c6405ab6938e8fe5ae7851fcf868a4c0e9ebd4fc9385ff999fd4ede16.exe
5320	jaffacakes118_c6780e9c6405ab6938e8fe5ae7851fcf868a4c0e9ebd4fc9385ff999fd4ede16.exe
5320	jaffacakes118_c6780e9c6405ab6938e8fe5ae7851fcf868a4c0e9ebd4fc9385ff999fd4ede16.exe
5320	jaffacakes118_c6780e9c6405ab6938e8fe5ae7851fcf868a4c0e9ebd4fc9385ff999fd4ede16.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c6780e9c6405ab6938e8fe5ae7851fcf868a4c0e9ebd4fc9385ff999fd4ede16.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c6780e9c6405ab6938e8fe5ae7851fcf868a4c0e9ebd4fc9385ff999fd4ede16.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

checkbox[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KNMT30O2\checkbox[1].htm
Size 114B
SHA256 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
MD5 e89f75f918dbdcee28604d4e09dd71d7
SHA1 f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA512 8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0
TLSH
T1EEB092DDBC61E48018E535511EA3B60D146A22EBB9018B4018C00836A96035F8D0AAC5
MD5 SHA1 SHA512 TLSH

Submit Download

jaffacakes118_c6780e9c6405ab6938e8fe5ae7851fcf868a4c0e9ebd4fc9385ff999fd4ede16.htm

Path C:\Users\Admin\AppData\Roaming\GetRightToGo\jaffacakes118_c6780e9c6405ab6938e8fe5ae7851fcf868a4c0e9ebd4fc9385ff999fd4ede16.htm
Size 87KB
SHA256 ca6005b88259d61bfc9943b1236cd4f6f12833f3134a3c1553545247d95aca2d
MD5 2290e78ddaffaa73838e9a67d679cbc7
SHA1 5e2583a2c5bad107c82cab2a495d559e1385ae41
SHA512 a2c6ae503b264e30925c685efb6389175138fb809989d5e4c61e62345662c0d7a6e0de57c6a8f883209c7bf613c6be3fb4ca2031876d562271c8b111ad338abc
SSDEEP 1536:REGyFGTDphMWPQpJ0G/UFmOgrt8/BeXdyIg99CO+hbjai8Zfo1sXmsKD52X4Qe7w:I8TaIFvpvEMuXDXzvvbyEs
TLSH
T168930AD9B2D6716387A731B864BF420BB03598AAB84C8850F068D9F5BE74E44407BF7D
MD5 SHA1 SHA512 SSDEEP TLSH