Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/10/2026, 16:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe
- Size 22KB
- Sample261006-tljsmsfe54
- SHA256 596eaad473c853f4f66997679f08da47d509a1df66122bca0bf14f88de32bd2e
- MD5 678bd0d512e75f1ee647dff2b8195d15
- SHA1 6c8505af72d86e9f3b3d51bc0463cc6c144cdfd0
- SHA512 a4801e84b5c608695e5a31a32dcada5b5a66448f7908aacad0664bbd529c504853b3d060e109f74626e08bd223280b18379b21a19d1d670b06028690abab075a
- SSDEEP 384:hqMLOiZdl4DvdKsRDlXzOz0docgdwNycbFyOO6R3TKDEW5AWU:hp6yLkvdKUhXzOz0dXkcbRW
- TLSH T1C4A28D1FF3B709B0C2C2E9740A56E5201065FD29CD91E6B5AAD15A3F3E378B0C0A9697
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" services.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0007000000024621-19.dat acprotect - Executes dropped EXE 1 IoCs
pid Process 4524 services.exe - Loads dropped DLL 1 IoCs
pid Process 4524 services.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Net = "C:\\Windows\\services.exe" jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Net = "C:\\Windows\\services.exe" services.exe - Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\H: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\K: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\S: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\V: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\W: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\I: services.exe File opened (read-only) \??\O: services.exe File opened (read-only) \??\T: services.exe File opened (read-only) \??\G: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\L: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\P: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\Q: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\R: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\N: services.exe File opened (read-only) \??\S: services.exe File opened (read-only) \??\W: services.exe File opened (read-only) \??\J: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\O: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\U: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\Y: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\Z: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\Q: services.exe \??\F:\ services.exe File opened (read-only) \??\N: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\Z: services.exe File opened (read-only) \??\E: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\I: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\T: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\X: jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\M: services.exe File opened (read-only) \??\X: services.exe File opened (read-only) \??\K: services.exe File opened (read-only) \??\R: services.exe File opened (read-only) \??\U: services.exe File opened (read-only) \??\V: services.exe File opened (read-only) \??\Y: services.exe File opened (read-only) \??\H: services.exe File opened (read-only) \??\J: services.exe \??\F:\ jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened (read-only) \??\E: services.exe File opened (read-only) \??\G: services.exe File opened (read-only) \??\L: services.exe File opened (read-only) \??\P: services.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\share.txt services.exe - Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\assistse.exe jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File created C:\Windows\assistse.exe services.exe File created C:\Windows\uninstall.exe services.exe File created C:\Windows\h00kdll.dll services.exe File created C:\Windows\assistse.exe jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File created C:\Windows\uninstall.exe jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File created C:\Windows\services.exe jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe File opened for modification C:\Windows\assistse.exe services.exe File created C:\Windows\services.exe services.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language services.exe - Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 4672 jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe 4672 jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe 4672 jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe 4672 jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe 4672 jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe 4672 jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe 4672 jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe 4672 jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe 4672 jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe 4672 jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe 4672 jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe 4672 jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe 4672 jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe 4672 jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe 4672 jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe 4672 jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe 4524 services.exe 4524 services.exe 4524 services.exe 4524 services.exe 4524 services.exe 4524 services.exe 4524 services.exe 4524 services.exe 4524 services.exe 4524 services.exe 4524 services.exe 4524 services.exe 4524 services.exe 4524 services.exe 4524 services.exe 4524 services.exe 4524 services.exe 4524 services.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4524 services.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4672 wrote to memory of 4524 4672 jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.qu.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\services.exeC:\Windows\services.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4524
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\h00kdll.dll
- Size 14KB
- SHA256 2c8f65d14556e6e1b61600611910b24532950398d32014f43014dbb5f64a9abd
- MD5 ed5bb902c7e2796d211d7765e3e186af
- SHA1 b8f3743491ca0373111c7ca9112a358d0a44f992
- SHA512 7a33abab97f88418c3f63d688b4456f4039b1b52b82709fdcf459643c7de9f78db7a36f04f5f82b9599be2adaef64b7e7b27e743e26060fc95c2e95e3aa9eb57
- SSDEEP 384:EDvib9DT1T3C/wBXeU82KQArIbGWAPCWD:EDvCDThqwVBKdF
- TLSH T158529F07F3B90966E2D36F742BE5C722113BF5F056A59B193B20011B3837261C97AA93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\web.exe
- Size 22KB
- SHA256 596eaad473c853f4f66997679f08da47d509a1df66122bca0bf14f88de32bd2e
- MD5 678bd0d512e75f1ee647dff2b8195d15
- SHA1 6c8505af72d86e9f3b3d51bc0463cc6c144cdfd0
- SHA512 a4801e84b5c608695e5a31a32dcada5b5a66448f7908aacad0664bbd529c504853b3d060e109f74626e08bd223280b18379b21a19d1d670b06028690abab075a
- SSDEEP 384:hqMLOiZdl4DvdKsRDlXzOz0docgdwNycbFyOO6R3TKDEW5AWU:hp6yLkvdKUhXzOz0dXkcbRW
- TLSH T1C4A28D1FF3B709B0C2C2E9740A56E5201065FD29CD91E6B5AAD15A3F3E378B0C0A9697
- MD5 SHA1 SHA512 SSDEEP TLSH