1955b63fc79e1a8e6aea3ddb00bc57a3aa3f2ff9a6edcfb16eb5eb46efdf144e

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/10/2026, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Agent.qwgixc.exe
Size 1.0MB
Sample261015-29pb2aef66
SHA256 1955b63fc79e1a8e6aea3ddb00bc57a3aa3f2ff9a6edcfb16eb5eb46efdf144e
MD5 8c706c03e02b996cb2083812eb380377
SHA1 d78e66492a98e03d6106e50babd19d493bb61fba
SHA512 6ab15d355a8c21fdf656d8356f47133420ec173e7eff0fc58c32e113b86939608a910849625cc0e2a525936586c5f8f3da2bf5a466789943230c2832ba34f06d
SSDEEP 12288:yPxo8jVvb1vs0i31Oqenh/oZPFGsaA5TGzUiTV+tOEQQaefVc9v6LAoNEO:yPxo8RhXi31qnf4UfToZc6LAom
TLSH
T129358E12779080B6E4BE033494B74F3197BEB9726B758BCBA784065D1D723C0AE35B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan.Win32.Agent.qwgixc.exe

Executes dropped EXE 1 IoCs

pid	Process
4780	fontsvr.exe

Loads dropped DLL 1 IoCs

pid	Process
4780	fontsvr.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Microsoft\system\msader15.dll	fontsvr.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\fontsvr.exe	jaffacakes118_Trojan.Win32.Agent.qwgixc.exe
File opened for modification	C:\Windows\fontsvr.exe	jaffacakes118_Trojan.Win32.Agent.qwgixc.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
1016	wmic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fontsvr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fontsvr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Agent.qwgixc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	jaffacakes118_Trojan.Win32.Agent.qwgixc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4780	fontsvr.exe
4780	fontsvr.exe
4780	fontsvr.exe
4780	fontsvr.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	4780	fontsvr.exe
Token: SeSecurityPrivilege	4780	fontsvr.exe
Token: SeIncreaseQuotaPrivilege	1016	wmic.exe
Token: SeSecurityPrivilege	1016	wmic.exe
Token: SeTakeOwnershipPrivilege	1016	wmic.exe
Token: SeLoadDriverPrivilege	1016	wmic.exe
Token: SeSystemProfilePrivilege	1016	wmic.exe
Token: SeSystemtimePrivilege	1016	wmic.exe
Token: SeProfSingleProcessPrivilege	1016	wmic.exe
Token: SeIncBasePriorityPrivilege	1016	wmic.exe
Token: SeCreatePagefilePrivilege	1016	wmic.exe
Token: SeBackupPrivilege	1016	wmic.exe
Token: SeRestorePrivilege	1016	wmic.exe
Token: SeShutdownPrivilege	1016	wmic.exe
Token: SeDebugPrivilege	1016	wmic.exe
Token: SeSystemEnvironmentPrivilege	1016	wmic.exe
Token: SeRemoteShutdownPrivilege	1016	wmic.exe
Token: SeUndockPrivilege	1016	wmic.exe
Token: SeManageVolumePrivilege	1016	wmic.exe
Token: 33	1016	wmic.exe
Token: 34	1016	wmic.exe
Token: 35	1016	wmic.exe
Token: 36	1016	wmic.exe
Token: SeIncreaseQuotaPrivilege	1016	wmic.exe
Token: SeSecurityPrivilege	1016	wmic.exe
Token: SeTakeOwnershipPrivilege	1016	wmic.exe
Token: SeLoadDriverPrivilege	1016	wmic.exe
Token: SeSystemProfilePrivilege	1016	wmic.exe
Token: SeSystemtimePrivilege	1016	wmic.exe
Token: SeProfSingleProcessPrivilege	1016	wmic.exe
Token: SeIncBasePriorityPrivilege	1016	wmic.exe
Token: SeCreatePagefilePrivilege	1016	wmic.exe
Token: SeBackupPrivilege	1016	wmic.exe
Token: SeRestorePrivilege	1016	wmic.exe
Token: SeShutdownPrivilege	1016	wmic.exe
Token: SeDebugPrivilege	1016	wmic.exe
Token: SeSystemEnvironmentPrivilege	1016	wmic.exe
Token: SeRemoteShutdownPrivilege	1016	wmic.exe
Token: SeUndockPrivilege	1016	wmic.exe
Token: SeManageVolumePrivilege	1016	wmic.exe
Token: 33	1016	wmic.exe
Token: 34	1016	wmic.exe
Token: 35	1016	wmic.exe
Token: 36	1016	wmic.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2088	jaffacakes118_Trojan.Win32.Agent.qwgixc.exe
4780	fontsvr.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 4780	2088	jaffacakes118_Trojan.Win32.Agent.qwgixc.exe	90
PID 4780 wrote to memory of 1016	4780	fontsvr.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.qwgixc.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.qwgixc.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\fontsvr.exe
  "C:\Windows\fontsvr.exe" 2088
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic cpu get processorid
    3⤵
    - Queries system WMI classes for hardware identifiers
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msader15.dll

Path C:\Program Files (x86)\Common Files\Microsoft\system\msader15.dll
Size 946KB
SHA256 6a06c6e26e81e701f641b99d1b5b5c08a63fd814d41b78f03d13db0aedd3cc40
MD5 a585579e3d8d3f8dcd55e5bddaa7d90c
SHA1 7cf2b39a2a294bccacff4f7d95f9aeaa7ba0d44d
SHA512 c4f33378e4c9696b4ebb247c2b95e50080e4d30555c3a22e2783fee25d324a5e75f7f56a9ba68a2c8ca7733032015975b905dd4d1e15644f59980a3ecb7cc3a3
SSDEEP 12288:9jVvb1vs0i31Oqenh/oZPFGsaA5TGzUiTV+tOEQQaefVc9v6LAoNEO:9RhXi31qnf4UfToZc6LAom
TLSH
T1DA258E12779080B6E4BE033894B74F3197BEB9726B758BCB6784065D1D723C0AE35B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontsvr.exe

Path C:\Windows\fontsvr.exe
Size 1.0MB
SHA256 1955b63fc79e1a8e6aea3ddb00bc57a3aa3f2ff9a6edcfb16eb5eb46efdf144e
MD5 8c706c03e02b996cb2083812eb380377
SHA1 d78e66492a98e03d6106e50babd19d493bb61fba
SHA512 6ab15d355a8c21fdf656d8356f47133420ec173e7eff0fc58c32e113b86939608a910849625cc0e2a525936586c5f8f3da2bf5a466789943230c2832ba34f06d
SSDEEP 12288:yPxo8jVvb1vs0i31Oqenh/oZPFGsaA5TGzUiTV+tOEQQaefVc9v6LAoNEO:yPxo8RhXi31qnf4UfToZc6LAom
TLSH
T129358E12779080B6E4BE033494B74F3197BEB9726B758BCBA784065D1D723C0AE35B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download