10e7e1eda0f344a319fb72fd49e77a51d36ee416bb8d5e685f48b1d2ce9accbf

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 19:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Killav.geq.exe
Size 42KB
Sample261009-xzrl7adv21
SHA256 10e7e1eda0f344a319fb72fd49e77a51d36ee416bb8d5e685f48b1d2ce9accbf
MD5 4963feddffa33935df4ac2b11f94a08c
SHA1 8f42ff63522c27ed6312ddd921ca4c27d07523d4
SHA512 34d0b2d38141e551efd4285b9d0ab7dc7b07b43f7b44f16184b7b4c6424537b423a770bbb8665eea97583826b86d364e8f021bdab8f7af7d0d7df64c485a228d
SSDEEP 768:1WFQx1mTijkWtLA5xN7YVdNVB1ZHmHGLYihWmPMvhsoXEqiEtxlha5hscci:K+jkW8xN0FVB1tmHGdhWsoHiE0s
TLSH
T1EB13C0D76D08D87BC38C55B345FB887EFBA815154277D2D282F2CCD819A0638EC79A85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

aspackv2 discovery vmprotect

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000f00000001b85b-1.dat	aspack_v212_v242

Loads dropped DLL 1 IoCs

pid	Process
4480	jaffacakes118_Trojan-Dropper.Win32.Killav.geq.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x000f00000001b85b-1.dat	vmprotect
behavioral2/memory/4480-4-0x00000000755E0000-0x00000000755EF000-memory.dmp	vmprotect

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lqcyc52.cyc	jaffacakes118_Trojan-Dropper.Win32.Killav.geq.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3952	4480	WerFault.exe	88
5148	4480	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Killav.geq.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Killav.geq.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Killav.geq.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 360
  2⤵
  - Program crash
  PID:3952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 456
  2⤵
  - Program crash
  PID:5148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4480 -ip 4480
1⤵
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4480 -ip 4480
1⤵
PID:5796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lqcyc52.cyc

Path C:\Windows\SysWOW64\lqcyc52.cyc
Size 31KB
SHA256 feaae8e7acf89e75a8b82d1a71489b5d87020f2729681ef6f7afc8e6bd9d7911
MD5 6109e00012584cf66916139ad49658a7
SHA1 152fc92ce7415b284f63515d0c27896e50011d81
SHA512 6b12727df080b9a806ca96f50bea8f6137a98c0945f17af53c67684a9a33e756164a30811cd0cc2461868d01f7510a5b3b8e38a2e1f684a8facdec56b9fb07bd
SSDEEP 768:+TijkWtLA5xN7YVdNVB1ZHmHGLYihWmPMvhsoXEqiEtxlha5:++jkW8xN0FVB1tmHGdhWsoHiE
TLSH
T1A9E2C0DB6D08C8BAC38C25B397F788AFEED829099077D6D081F5CCC51DE06385C69999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4480-4-0x00000000755E0000-0x00000000755EF000-memory.dmp

Download

memory/4480-7-0x0000000000E20000-0x0000000000E301A8-memory.dmp