8730ba0355c20eef9776ee43d3703680a36624f2e54154ad2579f59708a0042e

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Pincav.bqowv.exe
Size 937KB
Sample261018-srkrfset6r
SHA256 8730ba0355c20eef9776ee43d3703680a36624f2e54154ad2579f59708a0042e
MD5 d66efb276a03ecf1904abfcfbe36e904
SHA1 2344b257587a6773c6490b8a0c7fab98553662de
SHA512 1c19871f78e832099a111ba29799bdbc53c9392ee9a70d964cc3f3241b23a6013651e8aa672016c76dc61eb6b96d129c412f188a566884d72371a83e630c689a
SSDEEP 12288:Fh6PElDp1xA1BtXhDvAdDi8hnXL8ZNE+2M11RAprKSXGD1fQ9:vacDRAj2phnX2hA1eQ
TLSH
T1301523333AB0C9B2D24B8C7042CADBFACBB5709065596E8B77C42ECD3F64A5B0D60506
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000e00000001c4ba-2.dat	acprotect
behavioral2/memory/3120-5-0x00000000746C0000-0x00000000746C9000-memory.dmp	acprotect

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2376	explorer.exe

Loads dropped DLL 6 IoCs

pid	Process
3120	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe
3120	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe
3120	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe
3120	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe
3120	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe
3120	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3120 set thread context of 2376	3120	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe	88

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c4ba-2.dat	upx
behavioral2/memory/3120-5-0x00000000746C0000-0x00000000746C9000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\WOW6432Node\CLSID	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\WOW6432Node\CLSID\tst_key = "test_ok"	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3120	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe
3120	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe
3120	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe
3120	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe
3120	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe
3120	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe
3120	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe
3120	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 2376	3120	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe	88
PID 3120 wrote to memory of 2376	3120	jaffacakes118_Trojan.Win32.Pincav.bqowv.exe	88

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Pincav.bqowv.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Pincav.bqowv.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\system32\explorer.exe
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SelfDel.dll

Path C:\Users\Admin\AppData\Local\Temp\nseB26F.tmp\SelfDel.dll
Size 4KB
SHA256 281c39b733579e031c62bdd247b41543ece1fe3bd6eda26fc8ad474b10f33101
MD5 7cff7fe2caea5184d98c147e7e263132
SHA1 21f39d3d0dd5f7198d67ef30e95d10ae3460093e
SHA512 fb1161b8571d1d0c67e2df0d571b08f5e7a73f81409aed847344154d02406910629181bcce4e18e998ec472f51a6a1b40d956a010abdd10e850413aafa87808a
SSDEEP 48:CzHDh3jgWMynQfXKsJ3eAn67wN4VDm0pmoZSeJY8JTaCILFoyTFS7lWsaEaSueq:S18WMynkXKOOATEVUPnS7s9TShqTM
TLSH
T14F91F98467EC1656D4F607306BF193263C3EBC104979D3FE2888114A6CB165A9965F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nseB26F.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdmxusnad.dll

Path C:\Users\Admin\AppData\Local\Temp\nseB26F.tmp\mdmxusnad.dll
Size 540KB
SHA256 978221b411fd086f9e3ff636d7f74336e661b96a81a1ca745110ecdb34f4e6cb
MD5 7ba2f8896642316118d60b5a519be6e8
SHA1 32bd50b8f37784459ccd8e63163349dee5fe3c35
SHA512 3e6619837c98f9da1704f2b774de36fa54504aef1b0ca1620325447865399af5988330989fc577de9f789189d47e9082788c4adb719a1f8bb5796f9769e8edf3
SSDEEP 12288:12alVXPIg1UZedNdEAnd6jkhTtrf5oZPQ1ALltqjIhdXUHtcGpl:AalVXPIpZENsQhTtrf5o1Q1oNUKGpl
TLSH
T1FCC49D227DD58476CA7E0170F66DABB8F2F5A9314D62DC43DBA009BC5B3BE468005D2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcEx.dll

Path C:\Users\Admin\AppData\Local\Temp\nseB26F.tmp\nsProcEx.dll
Size 32KB
SHA256 e7a1c7da9b1d9f483b572e00aa9586c46fbc480dbc2accee5703ac223eea7071
MD5 ed7ba4dc1df007a788f0ef3dd65f95be
SHA1 62f88e158a03ff1bc70ac6e3cb993d91ff4e000c
SHA512 3f9f0a00b848dcc49af1c5c8b34e63452d448eb3626a5501be1b3207961c0ae9297010394b7e3cea3c27319d09dc3ae7731eb5d112fe9bacd30ae92cc8340bb0
SSDEEP 192:04EE8le+bTYR9GyNBV6s+6MWV/PDBWdb3OYX/0V8PaVu0NHY/0Nk/pzCqJkdsRTi:iDsM2BV6gCb310iC3x1C/pzCqJbxIKc
TLSH
T10CE2E802ED426072C36947B1266FAA2BA15DAD721BD555C3FBC60F1D0EBE0E37631A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3120-5-0x00000000746C0000-0x00000000746C9000-memory.dmp

Download

memory/3120-24-0x0000000002A20000-0x0000000002AAA000-memory.dmp

Download