467df317dae9da81fa2912f1ea9b821141119e6b9ee1b9032372a258ef9811e8

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.pv.exe
Size 136KB
Sample261006-tk9yfaaw5x
SHA256 467df317dae9da81fa2912f1ea9b821141119e6b9ee1b9032372a258ef9811e8
MD5 94d01fa3221fc1f5c0c54d7204338194
SHA1 3d881bf712f66b75f33687bc8d8d5f59c7df55fe
SHA512 21f90c8ab6cd509e7797005e5bb1916554bec62ccf129b022c78fd249e6823c974de7158a86b738c32aeb6ac3e0716ec15eca536162e469d54ff4d67f5b6124f
SSDEEP 1536:8PcMR30pxxwsLnZuX0Wgd3ynjr0mabPzElNMoqnP6XP+4SspFM7FsT2Gkp8qJnN:8PcCILZbynsJ/ElNMoqnB4hpaxsFktf
TLSH
T18CD3E05274A4EEAED22F46316982B5E3DF066DA174253D0F12533AD8C1F36C1FD81E26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c49a-8.dat	aspack_v212_v242

Executes dropped EXE 4 IoCs

pid	Process
5320	5.exe
3748	ywm.exe
4380	setup.exe
1940	_tdicli_.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\_tdiserv_ = "C:\\Windows\\system32\\_tdiserv_\\_tdicli_.exe"	setup.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\Windows\SysWOW64\_tdiserv_\AUTORUN.inf	setup.exe
File created	\??\D:\autorun.inf	_tdicli_.exe
File opened for modification	\??\D:\autorun.inf	_tdicli_.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\_tdiserv_\setup.exe	5.exe
File created	C:\Windows\SysWOW64\_tdiserv_\_tdicli_.exe	setup.exe
File created	C:\Windows\SysWOW64\_tdiserv_\TDI95DEV.VXD	setup.exe
File created	C:\Windows\SysWOW64\_tdiserv_\Config.dat	setup.exe
File created	C:\Windows\SysWOW64\tdi95dev.vxd	_tdicli_.exe
File created	C:\Windows\SysWOW64\_tdiserv_\setup.exe	setup.exe
File created	C:\Windows\SysWOW64\_tdiserv_\TdiUpdate.sys	setup.exe
File created	C:\Windows\SysWOW64\_tdiserv_\AUTORUN.inf	setup.exe
File created	C:\Windows\SysWOW64\_tdiserv_\Guid.txt	_tdicli_.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\5.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.pv.exe
File opened for modification	C:\Windows\ywm.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.pv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ywm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	_tdicli_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	_tdicli_.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ywm.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_tdicli_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Agent.pv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywm.exe

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe
3748	ywm.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
808	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3748	ywm.exe
Token: SeShutdownPrivilege	4380	setup.exe
Token: SeSecurityPrivilege	4380	setup.exe
Token: SeShutdownPrivilege	1940	_tdicli_.exe
Token: SeSecurityPrivilege	1940	_tdicli_.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 5320	1944	jaffacakes118_Trojan-Dropper.Win32.Agent.pv.exe	90
PID 1944 wrote to memory of 3748	1944	jaffacakes118_Trojan-Dropper.Win32.Agent.pv.exe	91
PID 3748 wrote to memory of 620	3748	ywm.exe	82
PID 3748 wrote to memory of 620	3748	ywm.exe	82
PID 3748 wrote to memory of 620	3748	ywm.exe	82
PID 3748 wrote to memory of 620	3748	ywm.exe	82
PID 3748 wrote to memory of 620	3748	ywm.exe	82
PID 3748 wrote to memory of 620	3748	ywm.exe	82
PID 3748 wrote to memory of 620	3748	ywm.exe	82
PID 3748 wrote to memory of 620	3748	ywm.exe	82
PID 5320 wrote to memory of 4380	5320	5.exe	92
PID 4380 wrote to memory of 1940	4380	setup.exe	93

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:620
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.pv.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.pv.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\5.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.pv.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5320
  - - C:\Windows\SysWOW64\_tdiserv_\setup.exe
      l
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops autorun.inf file
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4380
    - - C:\Windows\SysWOW64\_tdiserv_\_tdicli_.exe
        
        l
        5⤵
        Executes dropped EXE
        Drops autorun.inf file
        Drops file in System32 directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
- - C:\Windows\ywm.exe
    "C:\Windows\ywm.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5.exe

Path C:\Windows\5.exe
Size 96KB
SHA256 37f18f1d3e19570c31cecd28052680f4765d5846dd146300a6f795d46bd119aa
MD5 a2fe57b69384ec7f37d25570e09f0e92
SHA1 593076f4b51ccf61d2d520a5ff5410f557b9fb87
SHA512 13584a1dc04350749fcbec14941da3e8a32b8dcf29150fd9fda53657d02dfbd41fc85743d900f8eecc223f346fa93f544445e2bdcce5aefb557159eff8de8b08
SSDEEP 1536:wWiYtVT03NttNR4LJNR4Itl8s2V17z5dtDc2Apo0rlO5ImMKfjD:JY3Nt7+l4ItlOfzxD5ApROIKv
TLSH
T1FAA3E11278D2D177C49147FA51A4970AEF3B659407B684933FE08B49AF213D2EB3A317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Config.dat

Path C:\Windows\SysWOW64\_tdiserv_\Config.dat
Size 28B
SHA256 fc239f1a1414083e27731e32b7c0e8fe2ba3de341149b90069aa5982e5830008
MD5 10f7f7c0d7bbb2e5f5cc023f0d22df2d
SHA1 0ab6ab3a995508f3c71289224249c87d844ead5e
SHA512 7966da70889f99554fcc81160e8787e7fc650deed67cd049abb026947181f525702f434f19dadf7a734d77f94cdf7625c860cfe46a1dc86a3b468a00849df0ae
MD5 SHA1 SHA512

Submit Download

_tdicli_.exe

Path C:\Windows\SysWOW64\_tdiserv_\_tdicli_.exe
Size 40KB
SHA256 36b8047eb1a73baae79ba64a4e4a90b49acea4f033926773c7f0ceaa864c7d02
MD5 5a78b325801a57cffae093f7669b3d36
SHA1 2e8b16b27896693290538dc2e188fff730cebfec
SHA512 d1647c66f2938ae1ee384045e5af425003463580a373ff409f2bc402b1fba8a764e82d9d24e7b6327b5aa3b5c5d1e5c2c23474d5afa1b66988af557ae8cb7005
SSDEEP 768:oibJXqvtQE25TE9BZ4l/D2ezn9qq4BtRlu:1JXgQE2EVi/K8nElu
TLSH
T10E035B27AEF0C57BD8C3C1B2956D9787EF375405127586638F490E8A9BB27C1D83A306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autorun.inf

Path C:\Windows\SysWOW64\_tdiserv_\autorun.inf
Size 35B
SHA256 be81dc6fecd779b3e5a4cf5eca726875f9d48458c37ac09bfec87ce1d4387e09
MD5 8d2b35c80a0bccebd5e18404ac087019
SHA1 f019ad32517ba84d01c0de55e7f8f12260deaaff
SHA512 babdef86a7c3d491fa41f59e9f0e713a70fb3fc880d5c1286dedac4a633f6dccef0ab658eb9ffc5f21e8073360b66e5e9d33e8c78b6b3c249ce80ccdead74e8e
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\Windows\SysWOW64\_tdiserv_\setup.exe
Size 72KB
SHA256 78b186bb3331760e1d52888bfc9b5c959b37bebd22dda321a47764767c55906a
MD5 d9c0c0ab117a10b0c36d9ce4295d094b
SHA1 0d8ff2a59f4f57a186428f04161aa231c78ea1c9
SHA512 2fad2a763935479ec41a693354eebf33216139aec1fbf85dd84c62b096e8e99a94f37b9dd55553af02874bbb070341aa7f431a3cd07b9a10f9538a5651d34814
SSDEEP 1536:Nh49bwLPPk3N+Za04LJYPJgrnolo+zrMWCP9gNLmo:sGPk3N+MZkJgrnolvpCP4LF
TLSH
T13C73D12374D2C077C05285F64A988997AF7BB65117B290872FA80A9DFF363D1963B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tdi95dev.vxd

Path C:\Windows\SysWOW64\_tdiserv_\tdi95dev.vxd
Size 18KB
SHA256 cd4fc904865be3160a8ac6ba45d9ee5ed071a3880971df52c4b53180e7c67288
MD5 2563f067be55bdd6973199f82b1f3268
SHA1 21df7ec3269c92a541ac50120935de7fef405c98
SHA512 d55772f0c41a886a0c96ddf6d15a262ccd267b646537f07ea8fb44a1af9ad08cdbd55132a33589a31bb6e688879b72332dc41fa7924dc287354f2ea574d7d50d
SSDEEP 384:MsMX2P/7bvoBmB9FT3rF40urC24L9avXqRn7pCf06pBq:MsWKkBaXT3rFjj24pavXqRn7pCf3pBq
TLSH
T1C7822B40ED0060BED5F352F55CBE93B8CF68AB595323226BD7D4E9232B721D1EA111D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywm.exe

Path C:\Windows\ywm.exe
Size 27KB
SHA256 055dafa74f04cb9f1e340337081b2158bc45a63bd887ae0b6bad8f70f83efe23
MD5 54c2159da6716ed39b1e590cddd0986d
SHA1 8c943e3f2f09198ded226ebfc6c524fc38b12cb2
SHA512 61eaf8f379c6716f5ce08020eaa8d4690b6a3aa658c929c61ba4c38f18a975e907cf2570606a0e0d92852a15a8a8c1805f3578c49c8f04ac8757b21bdcf2d905
SSDEEP 384:HvL4HVE6dFgW+RLMP0Pk8W3OIasnDzD87aVvKL3BvtMMjiRuZt5GQAxQr6+e9PfW:H8WugW+RCWkAIaeP6NqMjigZv0xXha5
TLSH
T1A4C2E1D84EA4C8FED8CBA0F150C62B8BD57CE51E9112CA41E0FB68DF7489534A8848F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3748-13-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/3748-15-0x0000000000400000-0x0000000000411000-memory.dmp

Download