Overview

overview

7

Static

static

3

jaffacakes...dg.exe

windows10-2004-x64

7

jaffacakes...dg.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/10/2026, 15:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_Trojan-Dropper.Win32.Agent.hddg.exe
  • Size 247KB
  • Sample261006-tc7s4sds2l
  • SHA256 3672e05a01d8e9b64fbb50ddd71b4fae3f5f68c2350e4bf3dd64f0eb50f68cf2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Executes a file named after a Windows system binary 1 TTPs 16 IoCs

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.hddg.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.hddg.exe"
    1⤵
    • Executes a file named after a Windows system binary
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4492
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run_kl_file.bat" "
      2⤵
      • Enumerates connected drives
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:4352
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ins24C4.tmp.msi" /quiet
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5816
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5928
      • C:\Users\Admin\AppData\Local\Temp\inl2830.tmp
        C:\Users\Admin\AppData\Local\Temp\inl2830.tmp cdf1912.tmp
        3⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5880
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inl2830.tmp > nul
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2652
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3564
      • C:\Windows\SysWOW64\expand.exe
        expand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1732
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4368
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2744
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 53FC3503D07D8CEC86DC0C3D80042364
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1652

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        jm_setup_qvod[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MTNU6HGG\jm_setup_qvod[1].htm
        • Size 11KB
        • SHA256 b5bc80c286321d117d4faf28c8ecd32cd4499e926034205f6fbcd181c5c39469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cdf1912.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp
        • Size 768B
        • SHA256 d7a1d6a8cf5c3fbb85cd06147a599f5274630b86b1c89721f10a60c1bbe994d8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        run_dws_file.bat
        • Path C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat
        • Size 57B
        • SHA256 ec2415efef8620eb5301699b165768bba7884d69358bb93662eb9ff9bae122fc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        run_kl_file.bat
        • Path C:\Users\Admin\AppData\Local\Temp\run_kl_file.bat
        • Size 26B
        • SHA256 0fe404e349177b204405181c00c357c1ac82cbd04ca450e2faebeead2ef54b6d
        • MD5 SHA1 SHA512
        Submit Download

        tmp_ext_favurl_cab.bat
        • Path C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat
        • Size 98B
        • SHA256 2909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        °ËØÔɫͼ.url
        • Path C:\Users\Admin\Favorites\°ËØÔɫͼ.url
        • Size 154B
        • SHA256 afd3d42faa66d6703a32f2f5b41e0d679dd8210aacb284d1e46854207087cac7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        °Ù¹ÈµçÓ°.url
        • Path C:\Users\Admin\Favorites\°Ù¹ÈµçÓ°.url
        • Size 155B
        • SHA256 c544ab13bd785ea3d5792873dedb102e87ea9a3b28fb1283be2eaac363ce360c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ´´ÒµÍ¶×ʺÃÏîÄ¿.url
        • Path C:\Users\Admin\Favorites\´´ÒµÍ¶×ʺÃÏîÄ¿.url
        • Size 156B
        • SHA256 0296e167f4cfe36275cf1a705a6c56b30b15c0712ec5904b4ed3299f07beee8e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ¿´¿´µçÓ°.url
        • Path C:\Users\Admin\Favorites\¿´¿´µçÓ°.url
        • Size 158B
        • SHA256 41ef37f97f886f32ec9e4d9ebf58079442d8bc8b102e9487de2f3f7da36e8058
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ÃÀÅ®ÀÖÔ°.url
        • Path C:\Users\Admin\Favorites\ÃÀÅ®ÀÖÔ°.url
        • Size 157B
        • SHA256 b7ea84a9d48f22c799c3c3b96f29f0ae7c1b274e6402d6fbadae31fc053f2140
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MSI2D8E.tmp
        • Path C:\Windows\Installer\MSI2D8E.tmp
        • Size 48KB
        • SHA256 99f4e00b6908057a2fe5067ff6c8b6e32b5c07558ab79139dc4b998f1da4b517
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        favorites_url.cab
        • Path \??\c:\users\admin\appdata\local\temp\favorites_url.cab
        • Size 425B
        • SHA256 73f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/4492-40-0x0000000000400000-0x000000000046B000-memory.dmp
        Download

        memory/4492-0-0x0000000000400000-0x000000000046B000-memory.dmp
        Download

        memory/4492-2-0x00000000006C0000-0x00000000006C3000-memory.dmp
        Download

        memory/5880-91-0x0000000000400000-0x0000000000408000-memory.dmp
        Download