Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 15:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe
- Size 4.9MB
- Sample261006-s8shmac15j
- SHA256 1dcf3e1bafed013bcaff4029b2f548fa988f44615dadcf065f56c6a7564efb24
- MD5 92672a4882a7ec304f25143b7f275cf3
- SHA1 b7b683b95d99e29cafc4a1feacd5666c366f6cd7
- SHA512 d2e75179f8b0f9e19a3d36b0e443e265226250b52ec82ae3fa3d96ea7d1884a33a321134a636726d7b449ed2bf0cd56aa1581c8bedb54001adeb8764fab2a2f9
- SSDEEP 49152:Vihbq+7To/jeCrctrnkGa/UiaLtmTZIFvqSMx/6IgMOHadeimTXWFvT4N4nThj3+:QbHo/j70rnza8iaL4TZ1Dhm6v4N4d
- TLSH T18236E003E242C8B1E0240670D16797FBBB745F669E24CAA7E7D0FD667E31221863E25D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe \??\E:\ jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe Token: SeDebugPrivilege 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe Token: SeDebugPrivilege 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe Token: SeDebugPrivilege 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe Token: SeDebugPrivilege 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe 4888 jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.ejyq.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4888
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1