72fa72b560deb122c7f62617f168d460b9db21d66f3c387ff4c361ac19214d08

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Agent.qwfsqt.exe
Size 1.0MB
Sample261015-28tkcstvct
SHA256 72fa72b560deb122c7f62617f168d460b9db21d66f3c387ff4c361ac19214d08
MD5 8ef042f22959325f2f4017fd74c9af8e
SHA1 6e1c98da028f1baad8c894ee0b504ed3be68b3df
SHA512 e6882b7197745999a419b6467eb76dc41484816d0c6fe02f92307904b717d5350e4bf1b429d02fbf1425a3336122d21934b8b421d6d277818c4fd3b4ec6fdbaf
SSDEEP 24576:07blPdQD+o7djLK1EUL9C/AaOf8qwoSDPBCP1B26SQws:075alYLaOfGoeoPl
TLSH
T1E1352312D7B798B8E0DF9B7478F990061636BF253C38AE08F29E24C61B37AA0C51D755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution installer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4300	jaffacakes118_Trojan.Win32.Agent.qwfsqt.tmp

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3220	cmd.exe
5724	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Agent.qwfsqt.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Agent.qwfsqt.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2756-0-0x0000000000400000-0x000000000041C000-memory.dmp	innosetup
behavioral2/memory/2756-39-0x0000000000400000-0x000000000041C000-memory.dmp	innosetup

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 4300	2756	jaffacakes118_Trojan.Win32.Agent.qwfsqt.exe	89
PID 4300 wrote to memory of 3220	4300	jaffacakes118_Trojan.Win32.Agent.qwfsqt.tmp	90
PID 3220 wrote to memory of 5184	3220	cmd.exe	92
PID 4300 wrote to memory of 5724	4300	jaffacakes118_Trojan.Win32.Agent.qwfsqt.tmp	93
PID 5724 wrote to memory of 3896	5724	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.qwfsqt.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.qwfsqt.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\is-6HILP.tmp\jaffacakes118_Trojan.Win32.Agent.qwfsqt.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6HILP.tmp\jaffacakes118_Trojan.Win32.Agent.qwfsqt.tmp" /SL5="$60216,838611,85504,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.qwfsqt.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C java.exe -version 2> C:\javaInstall.txt
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3220
  - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
      java.exe -version
      4⤵
      PID:5184
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C java.exe -d64 -version 2> C:\javaInstall64.txt
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5724
  - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
      java.exe -d64 -version
      4⤵
      PID:3896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 7b7a759ffe53b273ab1449c7fd5ffedf444be5b23991058fa223114e992f2ddf
MD5 b295355d158b6d2bf08f7d3bc70d15de
SHA1 417b368d080f3c775ad4486d788d6eba5a873e29
SHA512 494393bbee666ecc11b67124f7413109c8f3435ed6f8712abbd9e3817d7fef061fa3767920d5241fb69bd0862527a8ba895036dd61bed5c13fc51ed73d40223a
MD5 SHA1 SHA512

Submit Download

jaffacakes118_Trojan.Win32.Agent.qwfsqt.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-6HILP.tmp\jaffacakes118_Trojan.Win32.Agent.qwfsqt.tmp
Size 724KB
SHA256 bd94cee81354b5ca7999e97cd56e92d6d4b26fae99fdd6666720bf2cf6b28744
MD5 ae6c60c55c4a95007b30781a5f023e24
SHA1 29a0d58a66118a30f27b1b5d8379ce38ae3850c0
SHA512 4b3c60d129735ee4e43324b977edc0071592ac9ca992f5b5517006658387ad6cda45243e8fcc069e50f26df91aceb0b2d93f84dbead593b33301ba0577953305
SSDEEP 12288:psMLIMoi3rPR37dzHRA6nX0D9OKWbO7SERb5rNUK1bce0Lyx9bH:qMcMoi3rPR37dzHRA6G7WbuSEmK50Lyf
TLSH
T10DF47C23F2B08837C1B32E789D5B82955936BD103E35B59776E81F0C4E796817A2F2D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaInstall.txt

Path C:\javaInstall.txt
Size 147B
SHA256 afdd2e30a49d992e02746954a658ca1d8af5460c2f70607ecdb2b68883cfc421
MD5 878f394e749aeb94775a31acccc09414
SHA1 4255a663fa9b4c141fde96869071d1d29450ced8
SHA512 23637278397943d779cab6b6f3730d5708c8374ac18bed4f4e6b69a63a7e5304d39c5c2c8c48206812d0a2f0cc209620c92c57a39bb489ec9fad63a323f5d12d
TLSH
T197C08C1A08A87C9461C31016623883C98730E328CAB5100202C84411E2919AF1730E22
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2756-0-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/2756-39-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/3896-35-0x00000175C2280000-0x00000175C2281000-memory.dmp

Download

memory/4300-6-0x00000000006F0000-0x00000000006F1000-memory.dmp

Download

memory/4300-40-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/4300-41-0x00000000006F0000-0x00000000006F1000-memory.dmp

Download

memory/5184-10-0x0000025E40B60000-0x0000025E40DD0000-memory.dmp

Download

memory/5184-20-0x0000025E3F2F0000-0x0000025E3F2F1000-memory.dmp

Download

memory/5184-21-0x0000025E40B60000-0x0000025E40DD0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads