Analysis
- max time kernel
150s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/10/2026, 10:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan.Win32.Loader.f.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan.Win32.Loader.f.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target jaffacakes118_Trojan.Win32.Loader.f.exe
- Size 38KB
- Sample261014-mflaysbx2k
- SHA256 9dbd784d22debbd089bde173cca707c94178958c6e3aed1616453633baea5893
- MD5 264aeb7713b54f89cb66a7007d546d97
- SHA1 8e6099319a879e3487e428ec8a614d947f922f4a
- SHA512 bf0da6003d7bd6978d4049ba6f82c616ea5106744faa39d83d4af2f9f9d39b01bce71b32c0b64fa069a7dec18b7fa410c73717bc28a31b4508f1f519fba70e51
- SSDEEP 768:P3PNGh5AEl3DXvBIsR7TZGTOVRp4nrdP5N1CETAgYmi5GIFEEUfz:tmt1jusiTuGnrp/xAgm5G+EE0z
- TLSH T1AF03E06807128B0DD39A5BBAA893923EFBB3064C4503C83DDD3AFAA17901F15E67C157
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 888 qucuqluqbv.td - Loads dropped DLL 1 IoCs
pid Process 1848 rundll32.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\SetUp.inf jaffacakes118_Trojan.Win32.Loader.f.exe File opened for modification C:\Windows\SysWOW64\SetUp.inf jaffacakes118_Trojan.Win32.Loader.f.exe File created C:\Windows\SysWOW64\lspwlnfsev.sd jaffacakes118_Trojan.Win32.Loader.f.exe File created C:\Windows\SysWOW64\qucuqluqbv.td jaffacakes118_Trojan.Win32.Loader.f.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\windows\run.bat jaffacakes118_Trojan.Win32.Loader.f.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan.Win32.Loader.f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qucuqluqbv.td Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1508 jaffacakes118_Trojan.Win32.Loader.f.exe 1508 jaffacakes118_Trojan.Win32.Loader.f.exe 1508 jaffacakes118_Trojan.Win32.Loader.f.exe 1508 jaffacakes118_Trojan.Win32.Loader.f.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe 1848 rundll32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1508 jaffacakes118_Trojan.Win32.Loader.f.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1848 rundll32.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1508 wrote to memory of 888 1508 jaffacakes118_Trojan.Win32.Loader.f.exe 86 PID 888 wrote to memory of 1848 888 qucuqluqbv.td 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Loader.f.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Loader.f.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\qucuqluqbv.tdC:\Windows\system32\qucuqluqbv.td2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\system32\lspwlnfsev.sd,mymain3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1848
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\lspwlnfsev.sd
- Size 64KB
- SHA256 ab44f5f66ce65d0110d7a51809a9f1d69037d010c61dbc4bfe1baea3c43f7eda
- MD5 04dfaa85d94e739e2892833459696985
- SHA1 5be72b2b9f3cc2e0534a9dbf7cd7a493fa640979
- SHA512 de3c21ac62818f08e77c445e74305659d86607acbad7a063468896d0a85ab7fd9243baf4681184e9513a2cf58761d55141f97d65f50e6fa1a0d5465332a3c714
- SSDEEP 768:Im17XC1QmdCzPAYTeaKKbz0NT/aBe16Zz3aex+QcAB/NIb1KeQkji0tocu9CAqc:IO7GCr+s0NTCB/ZjFkwybdQktocuR3
- TLSH T15D537D12B98144F3D34906756591CF3B563F79201BF488D36F2ADAEA1D322E6E53B2C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\qucuqluqbv.td
- Size 36KB
- SHA256 64de7d3fda76081842aa0fa9d1b16a7a9159246aeb7717745404511e27e80ca8
- MD5 34a6b7e1e65879240710c6bfaab73180
- SHA1 eba8de81aa436b83e33c41984e6144cb538e0767
- SHA512 e825b1c3f4de39a6ca55bbb12e1862be50eea8af8d2299fbd530beddc729230f3cc5821aa3ca5321052ff48ec6d351a340c55f870649848d56cb6ad660afff53
- SSDEEP 384:bAP7V5+6Cd7v9/zzebq9QyiynxGwCMwo1:bAP7P+NfJPioxGw5wo1
- TLSH T1FEF24C2378C20537C582817198F08B176B3F66661E71C4DFD7546A4A3F31AE9593A783
- MD5 SHA1 SHA512 SSDEEP TLSH