243a27b04c779453d7edab118ce21aa14868738b6187542900ac58932ad07e7d

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Injector.pcqn.exe
Size 10KB
Sample261009-xtkxfsty3k
SHA256 243a27b04c779453d7edab118ce21aa14868738b6187542900ac58932ad07e7d
MD5 70a6f140994b379edc2170af0a4ae452
SHA1 9da800e1448735edfdfbaa808873886552417243
SHA512 6aa50780b83838edaa2f5833fff706d8f48fb04c4f55f005b6df29bd69588d9ea25d21f60e5bd0ca8524d29cbedf0b63352353c12644734ff158b8ce1201d396
SSDEEP 192:Wsl3XeWSw1xObqns04jgWFc4yR3Zk5vk04zw4cHGTp61oyMl:rZXeW5O2T4j8XRGdk04zLcA61y
TLSH
T1D722E72FDE38D8A3C58400F007BFAB3EDE7759164238A77B570CC9990AD4647D96618B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Injector.pcqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3564	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3564	taskkill.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 3564	4392	jaffacakes118_Trojan-Dropper.Win32.Injector.pcqn.exe	85

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Injector.pcqn.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Injector.pcqn.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /t /im KSafeTray.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4392-0-0x0000000000400000-0x0000000000425260-memory.dmp

Download

memory/4392-2-0x0000000000400000-0x0000000000425260-memory.dmp