1f482dab4828940d7806906b8029f4498b1a53184a3f7154838d8d54b489918d

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Sysn.aigp.exe
Size 129KB
Sample260920-ythb1ayz7r
SHA256 1f482dab4828940d7806906b8029f4498b1a53184a3f7154838d8d54b489918d
MD5 241ce9cdde996e2500243d41d7076ce6
SHA1 bd7a0dd6ce409abd6ed947fbd658eca3d92914bf
SHA512 60b119de0b72530481968e0dd106af74db3f9dd4014162305ff4fba278b7612331d3ed9e89ed272d976859615c98588af3cd46402edae775caf7e6536428e0f6
SSDEEP 1536:pYJTMT/HOOWv1PrRQr5jZpCbspZdwPa7M5w9fxyCz+B1chI8Iiny5Z:8TMT/jlr5tpg4LM5w+L5Z
TLSH
T125D35A11BB60DA32C44040F2363ED272561E7472076F91A37BD5CB9A5AB13F46E3AB1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5092	qsnkbhaa.exe

Loads dropped DLL 1 IoCs

pid	Process
5092	qsnkbhaa.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe"	qsnkbhaa.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\qsnkbhaa.exe	jaffacakes118_Trojan-Dropper.Win32.Sysn.aigp.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3396	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qsnkbhaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Sysn.aigp.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4624	jaffacakes118_Trojan-Dropper.Win32.Sysn.aigp.exe
4624	jaffacakes118_Trojan-Dropper.Win32.Sysn.aigp.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4624	jaffacakes118_Trojan-Dropper.Win32.Sysn.aigp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 3396	4624	jaffacakes118_Trojan-Dropper.Win32.Sysn.aigp.exe	89
PID 3396 wrote to memory of 5092	3396	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Sysn.aigp.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Sysn.aigp.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\qsnkbhaa.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\SysWOW64\qsnkbhaa.exe
    C:\Windows\system32\qsnkbhaa.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4423.tmp

Path C:\Users\Admin\AppData\Local\Temp\4423.tmp
Size 2.1MB
SHA256 974e92b2a97436569c49462a80471bbc255a8b493fc90e2456996c09aed7518b
MD5 ab643592c60ae22b34fef0ff90dc0f07
SHA1 a7ded0b66d1e3e89b285f781e9defe00c6eb0528
SHA512 a1964a377f1499866f7c5d87a70004fc059140e4249502bca540bc3b92eae9e39605b082894a4246f5381fbacf5430f4797b40d405b9e1bcb3cc49c1ee9f33b3
SSDEEP 49152:FeSoNo12Vhg0TCHn0jyuCFUj+opuJo5h4vlng5M:F1oQ+hk+yusUbpuJo5h4x
TLSH
T1BEA58C23F45960A6CCF312F0914D773A92EC97308B2488C367B55AEBF9619C15B3279B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsnkbhaa.exe

Path C:\Windows\SysWOW64\qsnkbhaa.exe
Size 49KB
SHA256 25c9a990f8799395ac96b2170f89f53616563871258b45be6c9e10d4cfae7db4
MD5 26759a22f1442197dd26268189e7b7c3
SHA1 9cdffedfa04c01b180b65ff27e07fd378c2625ce
SHA512 daef0900a583cd5396bc2251a70af56a78879842051cbe2cf266cfb1169e3db545d8b4c5ccfa0831fef7261d6f041aa86bba21aa827bae9bd0dd0daab61007e6
SSDEEP 768:WZ1nMcNsMJ0D/shYg3ZdI/PM3yl61MMm55yyyyyyyhd9bj:WZpCbspZdwPa7M5w9f
TLSH
T1AC336C56B9A4E532C80000B1253AE3735A1FB4311B6F94937FD4CB6B4EB13E15A3EB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4624-1-0x00000000002E0000-0x0000000000303000-memory.dmp

Download