Overview

overview

8

Static

static

3

jaffacakes...gk.exe

windows10-2004-x64

8

jaffacakes...gk.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/10/2026, 23:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_Trojan.Win32.Agent.qwglgk.exe
  • Size 821KB
  • Sample261015-296ajsys4q
  • SHA256 42259f620de33f4271bd4a2c1cad7f21631c56034b5e0fd65a5a9609df74aecc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistencespywaretrojan

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Manipulates Digital Signatures 1 TTPs 4 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 6 IoCs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Runs .reg file with regedit 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.qwglgk.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.qwglgk.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3236
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c run.cmd
      2⤵
      • Drops file in Drivers directory
      • Checks computer location settings
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:780
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7za.exe
        7za.exe e -phWfRbHQLGN3XOqi1 tLyEGvwruO.7z
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2808
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9duWHeJDA.vbe" 877049134 noChannel installStart
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:976
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\Software\WWthr" /v UUID
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4644
        • C:\Windows\SysWOW64\reg.exe
          REG QUERY "HKEY_CURRENT_USER\Software\WWthr" /v UUID
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4144
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\Software\Tempthr" /v UUID
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2644
        • C:\Windows\SysWOW64\reg.exe
          REG QUERY "HKEY_CURRENT_USER\Software\Tempthr" /v UUID
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1264
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9duWHeJDA.vbe" 877049134 noChannel importCerts
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:3688
      • C:\Windows\SysWOW64\certutil.exe
        certutil -addstore Root TBBcP5zlvV.crt
        3⤵
        • Manipulates Digital Signatures
        • System Location Discovery: System Language Discovery
        PID:5084
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EiTvwk7bRE.exe
        EiTvwk7bRE.exe -f oMKS4AYtMj.pfx -p aaahahaa -t MACHINE -s TRUSTEDPEOPLE
        3⤵
        • Manipulates Digital Signatures
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        PID:800
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9duWHeJDA.vbe" 877049134 noChannel addNativeMessagingHost
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:3136
      • C:\Windows\SysWOW64\reg.exe
        REG ADD "HKLM\Software\Google\Chrome\NativeMessagingHosts\com.ww.fm" /ve /t REG_SZ /d C:\Users\Admin\AppData\Roaming\ww.fm\ww.json /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4284
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9duWHeJDA.vbe" 877049134 noChannel addHosts
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:3340
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9duWHeJDA.vbe" 877049134 noChannel addRegkeys
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:4940
      • C:\Windows\SysWOW64\regedit.exe
        regedit /S OwO7lakok1.reg
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:2984
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9duWHeJDA.vbe" 877049134 noChannel installSuccess
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:3564

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7za.exe
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7za.exe
        • Size 676KB
        • SHA256 e6855553350fa6fb23e05839c7f3ef140dad29d9a0e3495de4d1b17a9fbf5ca4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EiTvwk7bRE.exe
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\EiTvwk7bRE.exe
        • Size 36KB
        • SHA256 baf5227825effdd59086816d2e757bf8d2bac7d1164cb50333d45af581c2d22a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OwO7lakok1.reg
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OwO7lakok1.reg
        • Size 425B
        • SHA256 2d0a8e0f3f434a8d79d5765488f5cfcfc1781f5c06aaf8d39cbd80b1c0b55845
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        TBBcP5zlvV.crt
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TBBcP5zlvV.crt
        • Size 1KB
        • SHA256 46c116d33c5a9d041dad32717878b76e2fd46fa74189c8ab7dbfacfe0f38baa8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        h9duWHeJDA.vbe
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h9duWHeJDA.vbe
        • Size 1KB
        • SHA256 7c9384f62b40b6b4f92c368925e248f7067814cd08311577e30936286baf23dc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        oMKS4AYtMj.pfx
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\oMKS4AYtMj.pfx
        • Size 2KB
        • SHA256 1182a9c71d18b07a82ada2feaa68edbed2d0634f2bbbf5733df836f1f8846d9d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        rr.vbe
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rr.vbe
        • Size 2KB
        • SHA256 d7e78a71845b377b3169c11f13cd2883284d5952481c0ffe985730996ccf6984
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        run.cmd
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\run.cmd
        • Size 61B
        • SHA256 3c688e78b709bb4ab9249e421eaedef61acce044e9634cf864b4adf38c7b3231
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        tFzlNvPs0q.bat
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tFzlNvPs0q.bat
        • Size 1KB
        • SHA256 81a87c61b23832b6577ef1657286231e12339ccd4ef09193d6910d2c74ee16a1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        tLyEGvwruO.7z
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tLyEGvwruO.7z
        • Size 305KB
        • SHA256 e7128176f2555fc751079397ee3d7c561463bb1c366bdc0e2612846999f0173c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ww.bat
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ww.bat
        • Size 186B
        • SHA256 c164c22aa9fe7c7851a1324270c952a2c412b05615daf7fd2a3c90e9d59f7680
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ww.exe
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ww.exe
        • Size 1.3MB
        • SHA256 310c2f487bad8c31cf03542c68a4d65d26a177b36d3b44d37ea82177f35cab3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ww.json
        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ww.json
        • Size 190B
        • SHA256 b71b254e07ec995ed4b7a8e411fbb5e3e03d247a1d6ade807031dcf2441661a6
        • MD5 SHA1 SHA512 TLSH
        Submit Download