Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/10/2026, 22:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan.Win32.Chapak.avcp.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan.Win32.Chapak.avcp.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target jaffacakes118_Trojan.Win32.Chapak.avcp.exe
- Size 108KB
- Sample261018-16dkpawsas
- SHA256 8c87116c942dc756ee5e57268aa6370f69487c49096b8c05f6124cdfe246c36b
- MD5 a63c26ccb2fe0fe0f6e783cf78dad0d2
- SHA1 da2870f17216ff06932eca2365b24126452f77e0
- SHA512 069ed3632916806faea8fd69276dbf9d120665c3f170a375fa44d41bda2e3a77083591c1c1225d98fb243b229927a2375a18c396a474cb49a09a17e2539e62cd
- SSDEEP 1536:URw0FaTyWcu+dqa3DA7mOkbS++cjygDEhsWjcdWvZYBuO1QFQUY7zByPULU2vV:SaTi9zHS+Hy6EOSZYBxQFC7zBC72vV
- TLSH T17AB38B1336E1C4B1F563063618B49F42567FFE619BB59E9F3788124E1A342D08B72BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3128 lnqv.exe - Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 127 128.52.130.209 3128 lnqv.exe Destination IP 61 89.18.27.167 3128 lnqv.exe Destination IP 67 217.12.210.54 3128 lnqv.exe Destination IP 76 198.206.14.241 3128 lnqv.exe Destination IP 101 87.98.175.85 3128 lnqv.exe Destination IP 111 212.24.98.54 3128 lnqv.exe Destination IP 130 162.248.241.94 3128 lnqv.exe Destination IP 42 163.172.185.51 3128 lnqv.exe Destination IP 75 69.164.196.21 3128 lnqv.exe Destination IP 88 111.67.20.8 3128 lnqv.exe Destination IP 90 103.236.162.119 3128 lnqv.exe Destination IP 94 192.99.85.244 3128 lnqv.exe Destination IP 105 92.222.97.145 3128 lnqv.exe Destination IP 135 18.211.225.60 3128 lnqv.exe Destination IP 44 5.135.183.146 3128 lnqv.exe Destination IP 58 51.15.98.97 3128 lnqv.exe Destination IP 73 66.165.251.19 3128 lnqv.exe Destination IP 89 163.53.248.170 3128 lnqv.exe Destination IP 38 94.16.114.254 3128 lnqv.exe Destination IP 45 51.255.48.78 3128 lnqv.exe Destination IP 97 144.76.133.38 3128 lnqv.exe Destination IP 98 94.247.43.254 3128 lnqv.exe Destination IP 112 178.17.170.179 3128 lnqv.exe Destination IP 121 185.117.154.144 3128 lnqv.exe Destination IP 129 172.98.193.42 3128 lnqv.exe Destination IP 30 111.67.20.8 3128 lnqv.exe Destination IP 31 163.53.248.170 3128 lnqv.exe Destination IP 68 66.70.211.246 3128 lnqv.exe Destination IP 115 51.15.119.63 3128 lnqv.exe Destination IP 118 89.46.223.237 3128 lnqv.exe Destination IP 128 35.196.105.24 3128 lnqv.exe Destination IP 132 103.114.191.33 3128 lnqv.exe Destination IP 34 142.4.205.47 3128 lnqv.exe Destination IP 52 192.71.245.208 3128 lnqv.exe Destination IP 71 172.98.193.42 3128 lnqv.exe Destination IP 100 163.172.185.51 3128 lnqv.exe Destination IP 110 192.71.245.208 3128 lnqv.exe Destination IP 116 51.15.98.97 3128 lnqv.exe Destination IP 122 95.181.211.6 3128 lnqv.exe Destination IP 35 104.37.195.178 3128 lnqv.exe Destination IP 46 188.165.200.156 3128 lnqv.exe Destination IP 49 51.255.211.146 3128 lnqv.exe Destination IP 56 82.196.9.45 3128 lnqv.exe Destination IP 91 142.4.204.111 3128 lnqv.exe Destination IP 95 31.171.251.118 3128 lnqv.exe Destination IP 104 188.165.200.156 3128 lnqv.exe Destination IP 120 91.217.137.37 3128 lnqv.exe Destination IP 33 142.4.204.111 3128 lnqv.exe Destination IP 48 37.59.40.15 3128 lnqv.exe Destination IP 54 178.17.170.179 3128 lnqv.exe Destination IP 72 162.248.241.94 3128 lnqv.exe Destination IP 87 5.132.191.104 3128 lnqv.exe Destination IP 107 51.255.211.146 3128 lnqv.exe Destination IP 109 193.183.98.66 3128 lnqv.exe Destination IP 39 144.76.133.38 3128 lnqv.exe Destination IP 50 104.238.186.189 3128 lnqv.exe Destination IP 51 193.183.98.66 3128 lnqv.exe Destination IP 59 89.35.39.64 3128 lnqv.exe Destination IP 74 103.114.191.33 3128 lnqv.exe Destination IP 29 5.132.191.104 3128 lnqv.exe Destination IP 40 94.247.43.254 3128 lnqv.exe Destination IP 65 176.126.70.119 3128 lnqv.exe Destination IP 47 92.222.97.145 3128 lnqv.exe Destination IP 70 35.196.105.24 3128 lnqv.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Task1.job jaffacakes118_Trojan.Win32.Chapak.avcp.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3168 3016 WerFault.exe 85 - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname lnqv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain lnqv.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan.Win32.Chapak.avcp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnqv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Chapak.avcp.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Chapak.avcp.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 9882⤵
- Program crash
PID:3168
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3016 -ip 30161⤵PID:5904
-
C:\Users\Admin\AppData\Roaming\sfrhi\lnqv.exeC:\Users\Admin\AppData\Roaming\sfrhi\lnqv.exe1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3128
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\sfrhi\lnqv.exe
- Size 108KB
- SHA256 8c87116c942dc756ee5e57268aa6370f69487c49096b8c05f6124cdfe246c36b
- MD5 a63c26ccb2fe0fe0f6e783cf78dad0d2
- SHA1 da2870f17216ff06932eca2365b24126452f77e0
- SHA512 069ed3632916806faea8fd69276dbf9d120665c3f170a375fa44d41bda2e3a77083591c1c1225d98fb243b229927a2375a18c396a474cb49a09a17e2539e62cd
- SSDEEP 1536:URw0FaTyWcu+dqa3DA7mOkbS++cjygDEhsWjcdWvZYBuO1QFQUY7zByPULU2vV:SaTi9zHS+Hy6EOSZYBxQFC7zBC72vV
- TLSH T17AB38B1336E1C4B1F563063618B49F42567FFE619BB59E9F3788124E1A342D08B72BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Tasks\Task1.job
- Size 264B
- SHA256 d74b67f0ee1715571c1fd28e1b4c98d6897f6d8e81648d99f9928bc1ae5c0278
- MD5 755e17fc9126b2d2a9cfc4c3d668cef8
- SHA1 aa6b176abfc05435519f2bfd14d11f0e7840b098
- SHA512 790be15975c83b6af3a109c0d1aeac415fcf4b4a52de6c49287fc2ecd249529ba2b66eb485e9195b388a615d188f5f5964beed1e72f0a363424d81b440b254fb
- TLSH T10ED022822BBFE205E3B60F7807E5832283A8ED20B882930F006C0A0C0C22630CF613E0
- MD5 SHA1 SHA512 TLSH