616ab32df1bc1a75e5d12029abdfb5c6740d3f104318b54eef5b53b7bf1442f8

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/10/2026, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Agent.vp.exe
Size 13KB
Sample261015-31lp8aev2t
SHA256 616ab32df1bc1a75e5d12029abdfb5c6740d3f104318b54eef5b53b7bf1442f8
MD5 664ba910254bff9f5ee807dc2ed1a8aa
SHA1 1e325812676cc3b5620f90d927f72c0f76adc39d
SHA512 99776bb1e90cacb0919799b0317a2525a2e8a96a092147a54b84d08ff498e402022208663a7e61e67882f5dfc71d69f8c15303ab0911180efa1e38f86fb52b9c
SSDEEP 384:g3WcpR1/xSWqfbQZ1qUYEyEPuEIPZwBV:gG6R1/cfIyEPuEIhw
TLSH
T11052AF57EF1A4165D68FC277685D8A2CB2BCC97C3AA2CD832A5911E05DCCFD7B403119
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2888	jaffacakes118_Trojan.Win32.Agent.vp.exe
2888	jaffacakes118_Trojan.Win32.Agent.vp.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2ee25147-37d4-4640-832c-fccfac8b21d9}	jaffacakes118_Trojan.Win32.Agent.vp.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32:nqaa.dll	jaffacakes118_Trojan.Win32.Agent.vp.exe
File created	C:\Windows\system32:nqaa.dll	jaffacakes118_Trojan.Win32.Agent.vp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Agent.vp.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2ee25147-37d4-4640-832c-fccfac8b21d9}	jaffacakes118_Trojan.Win32.Agent.vp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2ee25147-37d4-4640-832c-fccfac8b21d9}\InprocServer32	jaffacakes118_Trojan.Win32.Agent.vp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2ee25147-37d4-4640-832c-fccfac8b21d9}\InprocServer32\ = "C:\\Windows\\system32:nqaa.dll"	jaffacakes118_Trojan.Win32.Agent.vp.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Windows\system32:nqaa.dll	jaffacakes118_Trojan.Win32.Agent.vp.exe
File opened for modification	C:\Windows\system32:nqaa.dll	jaffacakes118_Trojan.Win32.Agent.vp.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.vp.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.vp.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
PID:2888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4DEC.tmp

Path C:\Users\Admin\AppData\Local\Temp\4DEC.tmp
Size 9KB
SHA256 2640b72940aba822f85040290310fdc36860d667977cc696405850460896296c
MD5 a8426b69a3bfe23a5aac84614d098362
SHA1 dc1c00c0820b834a074fb6e5051b5488ebd109cb
SHA512 7bab2c52b043421a964c4072b0d280431bd786b48c6cb1bb8e88f2183e201577dc3e5108f5759b1c89b4d35b05957f16453524aa9c68f180b62eb65246f4e43c
SSDEEP 192:lWBtc/Qb5UDzHTz6OoF0tEisN4yyK2WjtCXt9KjObvXgtbi7:L4b5UDzHTz1oFoE94BJWjtCic
TLSH
T15C124B369B01D032ECD2053970173B62929DAB76E38768CBF75096A12AD36F0718F65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download