25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe
Size 1.3MB
Sample261002-ns8gpazarg
SHA256 25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94
MD5 85655be4cd532fe258eec1a8fb1aeb5e
SHA1 a69b727460f18fab6b6b28b1e3faba4c0dabe8f9
SHA512 df04d15fb8bb6633adb066268394ec93ac0212c6237c81b12c013512cda056336c3fbe327bbf635608ce0eddc40140f8f140ccce76859bc93fa0d6bd9a6a2f35
SSDEEP 24576:U4gx3oZ/Ncjyv9jIont30X+33OpfPFmcyou3agT3+nEp2222222222222222222O:lv/GoF5t3+pfPFmc5m3+nEp222222223
TLSH
T1C9556A219DC7807BE8BA07BEB96D5A3A201FE56037C551D393C4892A5AA7FD13DF7002
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware defense_evasion discovery spyware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Colors	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5096	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe
5096	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5096	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe
5096	jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_25036be9202054162f131b4675c06e659ec98a97d5e5e4a36daca7f7a7d84e94.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bg.png

Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\bg.png
Size 17KB
SHA256 4b96054d8e2b93abd71d1e8cadc86b9758c12d2837710263700d7875b2072024
MD5 0a3efa0dc55540c2bab10c3e6572bf8e
SHA1 8dd4e5f004457ffe15bc901b1833d6cf8a5213ef
SHA512 f02ea3df4650d5664dfc5ee419083ec58527f0a26242073a2e3a9b123dd6748e0ba48b07923e7272e5ceaba16457d4a64fa577779cf3ee8da0683ca2ac9ac853
SSDEEP 384:KdNbK3ZbTnaimZ9tc6czBRJHljgfbwoy2SXTnRLzMDlZ:QbK3ZHaRm6cVRx+jMDnNM
TLSH
T101828CB5652B8C55EC84257C58F725780B3603FE7D0CC883E1D2A46C4A1B1BE6B6CBD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kaspersky.gif

Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\kaspersky.gif
Size 4KB
SHA256 e0a0d2f03fffdb05f019b5e35869367606f24a00a26739bba825a6efb78bb98e
MD5 3628294f6268f76341671252c5a12b7b
SHA1 56999e1a278ae4a34c81d4f4b214b0d29818658e
SHA512 4d9d862b7ee122bc38f200e6bf4350ae1609c9c941db2b4dd64d71673750b9e5e79243c61d1362eaa70d74f5c640da5abb21fd6cb94791b69f16e9d5ad65c133
SSDEEP 96:fuceAA5H6AN7X2SrEUAxCcogUUm5lhWP6980KeBKPYf:2HAAJvqDZxCsmvdKleBKk
TLSH
T1DF913C4EE9452C8E2429B1A16CF31A5A1CDCDC41B465A38B2AC4DC1EF57907D61398BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

line.jpg

Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\line.jpg
Size 687B
SHA256 3d6815504f0f6d13dfc8b5fb2d513c61045e7ca22c80f1d1d71d3c2c0d9b1a42
MD5 5f531f03cbc69b5d9983ac5da233b568
SHA1 3420531da5c232f7ed82eb3775e1d2d7296a3144
SHA512 3bdd36cc827fc66fd99a2cd13f374725fe5b687b9548643b11db0728934404e82dc2adf78eee6944b1b97f9755d053868670f56b9224b21449e3e84a30a94011
TLSH
T12301F46E2CC33077E60F1B76450C675861477FCD31CB898A12CA3268DB1F29004935F2
MD5 SHA1 SHA512 TLSH

Submit Download

poster

Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\poster
Size 12KB
SHA256 db488502c7caaf65b307141f9a71e276d9310293dcf61002866f14802288a1d4
MD5 6e0e66d569c2a59863c5bd8854a7cdfb
SHA1 7d1b30f9a5137ce3acc743106034514339734c67
SHA512 fc628cb38714d3c1762ca1134342c84832a49253e04eafc73f09077bf6a1c12d8ae7fcb4ae8abe14e9ce28e44735283ba775280cbd2105fb20d901ea88c3da5c
SSDEEP 192:L+d1+XJvpEpPdoMnEzWO9Rr++GW3vF1EWU6moWKnhCftB/E0Yhr1TmvwlFVMItkE:qd1SpauBv9RPT3nEWNhEUhr1T46C1e
TLSH
T1C342CF9A6A2A43D8F1707FA015410FD07BECE5A5FC7259929741105FEE30BA318E3657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

preloader.gif

Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\preloader.gif
Size 53KB
SHA256 4ba70b046229753d67317a437dff9c8afec58c4cc47cc97bc34eeeb7d88608c7
MD5 f14349e2d7d2c701ec5dda854e26c4af
SHA1 7ae4e8d51ae468c026adad39a956d9a7baa9322a
SHA512 9fb9fc656dcd10bb290d30caea4c99d4ce5e0964ccb76a7f84da584f44f4c30036298a5f87b47b10c0c544fa684cb8e7e3aac10c3980ebd1ed39b74a986bc3b6
SSDEEP 768:7zwqj0tcTG1Q6opPCDlSo0wgyjqt8C26KRkYI4mUKsXUngzxl1Ig9fCP8c5t:fwqot11I6m/yjQ8MKvIgKwUnUxYXPPt
TLSH
T14533F1AB48C9DBCB5D18647435AE2EDB2D484CC594E9FCB25EE0D44CCE487AE1349B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

start.png

Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\img\start.png
Size 5KB
SHA256 03cf5440cfccb059ef9e01c2987a8cace6ece6419242516e963b82726ef5643f
MD5 392dfbc5a6aff281a5f51e3a210bd103
SHA1 55e0c81b8e57ec3cad57738ed2f496c3857d02e5
SHA512 2164dda079f51d849d7d122db94c88cbbf9adb343c3a2d2bd0f6474acd1dc1ee20878f5931f214042fa49a2ebf9fdf8243622cd84d5766f330f9241f2216bef1
SSDEEP 96:OAGgfpFpXQX6SaAM5Zpa1U2P51uLIN5VtEbjaIdWgi/6kd71w6eNPae:4QXLNAM5ZparPTuLiEbjnAaJke
TLSH
T1B1B16D4E4D425812A99DA8CB18EB08338B5FA8A0D59A9ED8D30213058DE65F5451ACAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\index.html
Size 10KB
SHA256 99a05f7aee83b6fdcc11080787bd5e4e475cfa445bf29ced09eefbe15b2f7374
MD5 19104920cee7532871d2e3bf72838fb5
SHA1 d2554fbe54d1814d2fe1008a75a8f7d9420e8215
SHA512 a0e4d8d4f370ac51e40fca9126b8eb07911b78a32286dd73587b691ddd7cc907a1aaa4a44825eedc7503726511cca428a1308209231cc8f9e7d0601172497b2a
SSDEEP 192:XgF26WFldP8TN48t7iNy/iEU8GP8bTziYiXhe:XxFldPmN48iNy/iEUjPGziYiXo
TLSH
T1E922D626B29E0439353346A172608FDA346B8E03B203C46077EE1432F7D6E795E277CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jquery-ui.min.1.8.0.js

Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery-ui.min.1.8.0.js
Size 202KB
SHA256 8b59592d67eadc703af6cdd5ba8d077f9f9485d01fb6405555614335f89be99b
MD5 a4fdd77e182bd2fabe300a47b5617a35
SHA1 e002b335c75b5edefcd251962f61f53a2ab8e0f2
SHA512 ddcccde1c129f8f71fb39685abc615c4202b8b3dfc12cedd7d9cca2f97b308fc14b64497826421fa9df3d1cf54bdae9c085051af0a8d393cd3d556a6578d4085
SSDEEP 3072:WpAlcXnwc+NAdbvTdaVhr4aoaj7/cEItIwCkGWCs3T:WqaB+NuchrbrsEItImGWfj
TLSH
T12B14084D7245363A8AEFE275102F260A723391599601C06CF438D9DEAEBDE44217FFB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jquery.min.1.6.4.js

Path C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery.min.1.6.4.js
Size 89KB
SHA256 232066e3f6f1351afdaee1acb70c409766641fd5669e0b55ce7c77fac0a857ef
MD5 219073097031d9c1a95a1291d66f3a10
SHA1 2b7996b01d90b7f424f2a2e6063947461db4b2b2
SHA512 9ad2745f96cf79a4d59393cc3fbb3958b244013f6798c12abe41e37fca80df3c7cedab4b47cbd197645c86b31077388ec8f01ea8d67c5feacbef95b1ae7582b5
SSDEEP 1536:pttlIQq8jYAJohe7evhKHIJvuUO7Qrb3qJz34yfbvTXYActjaO7UX5X8BZg1hJOw:fJjxpIpuokRjCra92Zp8++
TLSH
T1F293D7D9B2D67163C3B731B854AF5107B13698EAB84C8890F068D8E4BE74A48507BF7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5096-0-0x0000000000400000-0x000000000055D000-memory.dmp

Download

memory/5096-1-0x00000000065A0000-0x00000000065A1000-memory.dmp

Download

memory/5096-104-0x00000000065A0000-0x00000000065A1000-memory.dmp

Download