Overview

overview

10

Static

static

3

jaffacakes...vq.exe

windows10-2004-x64

10

jaffacakes...vq.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    06/10/2026, 16:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_Trojan-Dropper.Win32.StartPage.dvq.exe
  • Size 64KB
  • Sample261006-trnzjsfe72
  • SHA256 a1dd340eceb984bdc32a2813f471807ac94f005d874968c55a370104e4ce963e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 11 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 9 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.StartPage.dvq.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.StartPage.dvq.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Checks computer location settings
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\Windows\SysWOW64\attrib.exe
      "C:\Windows\System32\attrib.exe" "C:\Program Files (x86)\Microsoft\soft1\Internet Explorar" +s
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Views/modifies file attributes
      PID:5472
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\temp_c.bat" "
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:5748

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Desktop.ini
        • Path C:\Program Files (x86)\Microsoft\soft1\Internet Explorar\Desktop.ini
        • Size 75B
        • SHA256 bc4eaf790a990a2dbb8460775c257f603d2303a7ab282dd5f405264af202282c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        target.lnk
        • Path C:\Program Files (x86)\Microsoft\soft1\Internet Explorar\target.lnk
        • Size 1KB
        • SHA256 03eb39cce8d8d69e6096f62da4f748d5d9f26abc9690be45cd29d3314ceb97ac
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AccessControl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nscEE84.tmp\AccessControl.dll
        • Size 10KB
        • SHA256 4209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nscEE84.tmp\System.dll
        • Size 11KB
        • SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        temp_c.bat
        • Path C:\Users\Admin\AppData\Local\Temp\temp_c.bat
        • Size 218B
        • SHA256 f9949078cef76cd6419f68446d84d8a9116b962ef7eecc574c94895568120d40
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Internet Explorar.ofc
        • Path C:\Users\Public\Desktop\Internet Explorar.ofc
        • Size 3KB
        • SHA256 f3773735bdae040b28c801c78377784b669311c1ff659814b987e1e9b9bc9999
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ÌÔ ±¦ Íø ¹º.lnk
        • Path C:\Users\Public\Desktop\ÌÔ ±¦ Íø ¹º.lnk
        • Size 1010B
        • SHA256 3808e5ceae259f656b45361840daecff6c0e753a2e03cc490d7ce550ffb8b56f
        • MD5 SHA1 SHA512 TLSH
        Submit Download