Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 19:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Dropper.Win32.Wardat.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-Dropper.Win32.Wardat.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target jaffacakes118_Trojan-Dropper.Win32.Wardat.exe
- Size 58KB
- Sample261012-yjs1razwfv
- SHA256 ec7eb574cb6fac6d09f3f59abd5c33b5d714194221a806f5377d01781c695c56
- MD5 6cbe14b20d7249c9fe68368d2c4d87ea
- SHA1 c63daef515221f78446c46bc2989a07f054e7810
- SHA512 6bd9100e14c001c5c2440dbc7c908869f1ca1cd5e38ce7b1778da0cde51294e67106593fa308de41161452f3827299080a5b749dec48af65ac1a06e4169a3296
- SSDEEP 768:/QaItPpWky/MmRYXwQFjnRJVgItcvl7zqnug8VUDdnXcmX:/pIykyUmRYAGV3q9zqugSAdnXcA
- TLSH T10B43AD319F6E1592FB1E4B764311529146A2FC3017A6E92F6D94732CEE78AE209A034E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\COM Service = "C:\\Windows\\msagent\\msqvbs.com" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\COM Service = "C:\\Windows\\msagent\\msqvbs.com" svchost.exe Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run svchost.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42CE4021-DE03-E3CC-EA32-40BB12E6015D} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42CE4021-DE03-E3CC-EA32-40BB12E6015D}\StubPath = "C:\\Windows\\system32\\mssdmu.com" svchost.exe - Executes dropped EXE 2 IoCs
pid Process 4888 tmgr32.exe 4792 svchost.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\mssdmu.com svchost.exe File created C:\Windows\SysWOW64\mslg.blf svchost.exe File opened for modification C:\Windows\SysWOW64\mslg.blf svchost.exe File opened for modification C:\Windows\SysWOW64\mssdmu.com tmgr32.exe File created C:\Windows\SysWOW64\mssdmu.com tmgr32.exe File opened for modification C:\Windows\SysWOW64\mssdmu.com svchost.exe -
resource yara_rule behavioral2/files/0x000e00000001c577-5.dat upx behavioral2/memory/4888-6-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4888-10-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4792-15-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4792-16-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4792-17-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4792-22-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4792-23-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4792-26-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4792-31-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4792-32-0x0000000000400000-0x000000000041D000-memory.dmp upx - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\svchost.exe tmgr32.exe File opened for modification C:\Windows\msagent\msqvbs.com tmgr32.exe File created C:\Windows\msagent\msqvbs.com tmgr32.exe File opened for modification C:\Windows\tmgr32.exe tmgr32.exe File opened for modification C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\tmgr32.exe jaffacakes118_Trojan-Dropper.Win32.Wardat.exe File created C:\Windows\svchost.exe tmgr32.exe File created C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\msagent\msqvbs.com svchost.exe File created C:\Windows\msagent\msqvbs.com svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-Dropper.Win32.Wardat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmgr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString tmgr32.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 tmgr32.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4792 svchost.exe - Suspicious use of AdjustPrivilegeToken 54 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4888 tmgr32.exe Token: SeSecurityPrivilege 4888 tmgr32.exe Token: SeTakeOwnershipPrivilege 4888 tmgr32.exe Token: SeLoadDriverPrivilege 4888 tmgr32.exe Token: SeSystemProfilePrivilege 4888 tmgr32.exe Token: SeSystemtimePrivilege 4888 tmgr32.exe Token: SeProfSingleProcessPrivilege 4888 tmgr32.exe Token: SeIncBasePriorityPrivilege 4888 tmgr32.exe Token: SeCreatePagefilePrivilege 4888 tmgr32.exe Token: SeBackupPrivilege 4888 tmgr32.exe Token: SeRestorePrivilege 4888 tmgr32.exe Token: SeShutdownPrivilege 4888 tmgr32.exe Token: SeDebugPrivilege 4888 tmgr32.exe Token: SeSystemEnvironmentPrivilege 4888 tmgr32.exe Token: SeRemoteShutdownPrivilege 4888 tmgr32.exe Token: SeUndockPrivilege 4888 tmgr32.exe Token: SeManageVolumePrivilege 4888 tmgr32.exe Token: 33 4888 tmgr32.exe Token: 34 4888 tmgr32.exe Token: 35 4888 tmgr32.exe Token: 36 4888 tmgr32.exe Token: SeIncreaseQuotaPrivilege 4792 svchost.exe Token: SeSecurityPrivilege 4792 svchost.exe Token: SeTakeOwnershipPrivilege 4792 svchost.exe Token: SeLoadDriverPrivilege 4792 svchost.exe Token: SeSystemProfilePrivilege 4792 svchost.exe Token: SeSystemtimePrivilege 4792 svchost.exe Token: SeProfSingleProcessPrivilege 4792 svchost.exe Token: SeIncBasePriorityPrivilege 4792 svchost.exe Token: SeCreatePagefilePrivilege 4792 svchost.exe Token: SeBackupPrivilege 4792 svchost.exe Token: SeRestorePrivilege 4792 svchost.exe Token: SeShutdownPrivilege 4792 svchost.exe Token: SeDebugPrivilege 4792 svchost.exe Token: SeSystemEnvironmentPrivilege 4792 svchost.exe Token: SeRemoteShutdownPrivilege 4792 svchost.exe Token: SeUndockPrivilege 4792 svchost.exe Token: SeManageVolumePrivilege 4792 svchost.exe Token: 33 4792 svchost.exe Token: 34 4792 svchost.exe Token: 35 4792 svchost.exe Token: 36 4792 svchost.exe Token: 33 4792 svchost.exe Token: SeIncBasePriorityPrivilege 4792 svchost.exe Token: 33 4792 svchost.exe Token: SeIncBasePriorityPrivilege 4792 svchost.exe Token: 33 4792 svchost.exe Token: SeIncBasePriorityPrivilege 4792 svchost.exe Token: 33 4792 svchost.exe Token: SeIncBasePriorityPrivilege 4792 svchost.exe Token: 33 4792 svchost.exe Token: SeIncBasePriorityPrivilege 4792 svchost.exe Token: 33 4792 svchost.exe Token: SeIncBasePriorityPrivilege 4792 svchost.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3332 jaffacakes118_Trojan-Dropper.Win32.Wardat.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3332 wrote to memory of 4888 3332 jaffacakes118_Trojan-Dropper.Win32.Wardat.exe 89 PID 4888 wrote to memory of 4792 4888 tmgr32.exe 90 PID 4888 wrote to memory of 4308 4888 tmgr32.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Wardat.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Wardat.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\tmgr32.exeC:\Windows\tmgr32.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\svchost.exeC:\Windows\svchost.exe3⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4792
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Windows\tmgr32.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4308
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\mslg.blf
- Size 75B
- SHA256 e4718e55e3351403178c3b8bef88de4ff705ef3c5bee1b67615cf3dc447885c3
- MD5 b8168a22fed68be94e35bbca502170f4
- SHA1 6b41c6b9f818acd9cec496cfd0823d35c39b97d9
- SHA512 e028bd82f83695259ea248f1a4108ebde89960de60ba72ff16d0960e13a901223a6916244285cabc6afab9cb6fdc889a74d0d1e6e6a0dfc941ba5e8b2dbe8e98
- TLSH T1B8A02400CD5FC40F0441DCC330050D4D40545C1F001747045153134CC3C343530CCCD1
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\mslg.blf
- Size 97B
- SHA256 dee5a6e890728cfdbbb9490a18fdd97a158c157652064f9ac2f9b0a17bdebfa7
- MD5 0b5c0c37eb67d22704d31304ad6462ed
- SHA1 ea1a73f0811f1ee26749ca04d53b4f2dfdd71195
- SHA512 3590c4e89aa4b46318f11e282d5c1bf365bbafdff8b12e044a5a0cea62295498e4d04e1ac973337e74f056a2ffd1d1dfd1f059dc63d3a11c3b2b73ac928ede27
- TLSH T194B01200CD6FC40F4CB1E9C230864D5D8094596F0417470491D3134C83C747931DDCD1
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\mslg.blf
- Size 154B
- SHA256 f747afeefbac1b6f22615c39457a218b24dd2cbf12094c56d40c945bdc318922
- MD5 e9170c9be41cf9c92ccd82e04d0dbf16
- SHA1 3830876968cca12b4bccbeec7a35f4f355d85c72
- SHA512 cbf9bf31f3d4ef1fcaa2ea22a4c501703d7df6840fab6f22135add1832786c4f8366bf4780d975b2dd1935cf4c4a0ef79ba272d8d2327dae651233b584adb708
- TLSH T1F5C08C00C82B844E48A4F49221654EDA68A1999B951A4708A5B323AC9AC242D31D9CE5
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\tmgr32.exe
- Size 30KB
- SHA256 099e70b103cdcc6fa6743763ee07e7b2b1b5f5a9a07c8c26d3e34399170d3067
- MD5 55988239c3f6a7eb1ee094410e067f06
- SHA1 8bbf00d2fd803b2f12cba63571f43e9dc5f64e63
- SHA512 e75dc41b52d41a245749d2f38d958d242929ca1057056ce4c32aab7ba5040c647900e97981e6e15d44d18987d5c96c37e08bef96134b9044f45be1c6b2b69dad
- SSDEEP 768:gb3EhwiDVnjNL2K1IfnrzMkg8vUF17HcAT:gb3ESqLh1IzzMkggy17Hcs
- TLSH T1DAD2D01A89A72782CF0F463A2311A7E48DA69D710759623746F0735E2CFF2F25F9468C
- MD5 SHA1 SHA512 SSDEEP TLSH