Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/10/2026, 19:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe
- Size 2.5MB
- Sample261009-ynnxlaszhy
- SHA256 3139d4544d608dacf4b6eef4a7e531c202e8888472aee5106ac912e13036f716
- MD5 0f6fbc565fd2b8527f020a219fdc9f40
- SHA1 689254a52bc0bed7df51709cbd3c09c6ee5fb4d1
- SHA512 a51bfc725715d1436f12faa2209621a845d60fabe062f59624f57b1b3c127b81fceb08a58f1b315868eb9a399af7fd021ddbffbb4639cf7ef1c2e9d4a658054f
- SSDEEP 49152:CduIWbq02OldkyRXj3BHYSI3rBDCioaIdNy2E9LK14yfSbCU4GusMC01X5J1DO1+:YOq9OldkOXjRHYSIbBDCioaId42EZKpE
- TLSH T13BC533E2930A85A0C47B6E70165F422D5D3D3DCD387747D4CA46F00F49BEA699EB124B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 5472 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe 5472 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\qdisp.dll jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\VersionIndependentProgID jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InprocServer32\ThreadingModel = "Apartment" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\ = "QMDispatch 1.0 Type Library" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D} jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\ProxyStubClsid32 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\TypeLib\ = "{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\TypeLib jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InprocServer32 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\ProxyStubClsid32 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\TypeLib\Version = "1.0" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\CLSID jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ProgID jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80} jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InprocServer32\ = "C:\\Windows\\SysWow64\\qdisp.dll" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine.1\ = "QMVBSRoutine Class" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\0 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\TypeLib\Version = "1.0" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\InprocHandler32 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\VersionIndependentProgID\ = "QMDispatch.QMRoutine" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\CLSID\ = "{241D7F03-9232-4024-8373-149860BE27C0}" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\ = "QMVBSRoutine Class" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\InprocServer32 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\TypeLib jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127} jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B} jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ProgID\ = "QMDispatch.QMRoutine.1" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\CurVer jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMFunction\ = "QMDispatch.QMFunction" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine.1\CLSID\ = "{C07DB6A3-34FC-4084-BE2E-76BB9203B049}" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\TypeLib\ = "{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine.1\CLSID\ = "{241D7F03-9232-4024-8373-149860BE27C0}" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine\ = "QMVBSRoutine Class" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\HELPDIR jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\ = "IQMRoutine" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMFunction\CLSID\ = "{EBEB87A4-E151-4054-AB45-A6E094C5334B}" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC} jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InprocServer32\ThreadingModel = "Apartment" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine.1 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0} jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\TypeLib jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\ = "IQMRoutine" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\ProgID jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\InprocHandler32 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine.1\CLSID jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMVBSRoutine jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\TypeLib\ = "{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\ = "IQMVBSRoutine" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\TypeLib jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMFunction jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\ProgID\ = "QMDispatch.QMFunction" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JAFFAC~1.EXE" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\ = "QMRoutine Class" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\CLSID jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\ProgID jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{241D7F03-9232-4024-8373-149860BE27C0}\VersionIndependentProgID jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\FLAGS jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\qdisp.dll" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6081CD7D-B4FB-4DED-BDA7-EBF8C23DC127}\ = "IQMVBSRoutine" jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5472 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5472 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 5472 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe 5472 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe 5472 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe 5472 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe 5472 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe 5472 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe 5472 jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Small.ezo.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5472
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\cfgdll.dll
- Size 45KB
- SHA256 ec4f7a4bce0407f7d04492e036b149b5db0224231b8ecbb77eb88cf94507be3a
- MD5 1479c26076bb69ef920b567bbe166fb5
- SHA1 725b96c0aa4d3ed117ab4f9ddedc5243b1b5b489
- SHA512 afad589f9c512ba40149a25055ec9beba761933a64aed3b10aa4263150adcfad7b0c93e94c173a97e446117f2b4006861914944856be1bf227b04ce6704068b3
- SSDEEP 768:lhbAfeW9TA4T69ZddOcQ20t4pmjBtFJcLHvsMQ:l5ueITAgYZd7H0EwtvcTy
- TLSH T122236EA136E04273E3EF5A3056F8AB3A9D7BB8515AB484475B2295C92C703E0ED3D307
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\qdisp.dll
- Size 53KB
- SHA256 1d05de2bfd0991c8bd9fa1544e432ee801756993986b0e90fa242c42a79307f5
- MD5 099838813910ccf33d31db9ba56ce4b5
- SHA1 7dd60cf1c8a8cadd04d93b766131626726c34a89
- SHA512 da6bb0124a617e3329c33d15bed3e9a5a6c246662f0f01795784ac141f90573e5d61115eb96a5be04e5d8fc9d671032e78f333f515d33ec783a90a0732baeb16
- SSDEEP 768:iBxYBtMnGvZP+H/tqUsGgQgcfcVLyJyBiLHvsT5:YWBtMn4UVqUsGgQgckVLfYTw
- TLSH T1AD335B4277D5C4B3D3AC02346A65A3A96BB7FE506CE184071B3533DD2E7A3A5D92C20B
- MD5 SHA1 SHA512 SSDEEP TLSH