bbb604d64a3063fa6cc756a3ce2df01cda74bea334aca6088474ef80d872e08c

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Worm.Win32.Qvod.pkl.exe
Size 139KB
Sample261018-tgbapsgs21
SHA256 bbb604d64a3063fa6cc756a3ce2df01cda74bea334aca6088474ef80d872e08c
MD5 aeb6cb4c727bfd7e6a2ece2814816586
SHA1 62d68def4af13e513f426213bf8bb508e6b46e4e
SHA512 0d5ec891a4d3e1fd5832b6eb64bf050e1201312cbb5b06d7e09afac25915f21ba65ae13fabd7784356b936e5e24e048af50f59f82c442bd336107d0fc9d3a344
SSDEEP 3072:zH+Mcv5JXXieDEzAEy1W7rkD+bnAIhRQaNZ:zHl0ndEEJgkCAaRTb
TLSH
T1C5E39E729541E873C24601726122AB6F1EA96F371778ECAFC7505AC93EF92E2D230357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 14 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	jaffacakes118_Worm.Win32.Qvod.pkl.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	jaffacakes118_Worm.Win32.Qvod.pkl.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	jaffacakes118_Worm.Win32.Qvod.pkl.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll"	jaffacakes118_Worm.Win32.Qvod.pkl.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll"	jaffacakes118_Worm.Win32.Qvod.pkl.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll"	jaffacakes118_Worm.Win32.Qvod.pkl.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	jaffacakes118_Worm.Win32.Qvod.pkl.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	jaffacakes118_Worm.Win32.Qvod.pkl.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll"	jaffacakes118_Worm.Win32.Qvod.pkl.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll"	jaffacakes118_Worm.Win32.Qvod.pkl.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll"	jaffacakes118_Worm.Win32.Qvod.pkl.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll"	jaffacakes118_Worm.Win32.Qvod.pkl.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	jaffacakes118_Worm.Win32.Qvod.pkl.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	jaffacakes118_Worm.Win32.Qvod.pkl.exe

Loads dropped DLL 16 IoCs

pid	Process
2864	svchost.exe
3544	svchost.exe
5412	svchost.exe
260	svchost.exe
4584	svchost.exe
4584	svchost.exe
5784	svchost.exe
5784	svchost.exe
2236	svchost.exe
4296	svchost.exe
1712	svchost.exe
4732	svchost.exe
3428	svchost.exe
3428	svchost.exe
2492	svchost.exe
2492	svchost.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	jaffacakes118_Worm.Win32.Qvod.pkl.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	jaffacakes118_Worm.Win32.Qvod.pkl.exe
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	jaffacakes118_Worm.Win32.Qvod.pkl.exe
File opened for modification	C:\Windows\SysWOW64\SRService.dll	jaffacakes118_Worm.Win32.Qvod.pkl.exe
File opened for modification	C:\Windows\SysWOW64\WmdmPmSp.dll	jaffacakes118_Worm.Win32.Qvod.pkl.exe
File opened for modification	C:\Windows\SysWOW64\LogonHours.dll	jaffacakes118_Worm.Win32.Qvod.pkl.exe
File opened for modification	C:\Windows\SysWOW64\PCAudit.dll	jaffacakes118_Worm.Win32.Qvod.pkl.exe
File opened for modification	C:\Windows\SysWOW64\helpsvc.dll	jaffacakes118_Worm.Win32.Qvod.pkl.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	jaffacakes118_Worm.Win32.Qvod.pkl.exe
File opened for modification	C:\Windows\SysWOW64\Ias.dll	jaffacakes118_Worm.Win32.Qvod.pkl.exe
File opened for modification	C:\Windows\SysWOW64\Nla.dll	jaffacakes118_Worm.Win32.Qvod.pkl.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	jaffacakes118_Worm.Win32.Qvod.pkl.exe
File opened for modification	C:\Windows\SysWOW64\Wmi.dll	jaffacakes118_Worm.Win32.Qvod.pkl.exe
File opened for modification	C:\Windows\SysWOW64\uploadmgr.dll	jaffacakes118_Worm.Win32.Qvod.pkl.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Worm.Win32.Qvod.pkl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
436	jaffacakes118_Worm.Win32.Qvod.pkl.exe
436	jaffacakes118_Worm.Win32.Qvod.pkl.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Worm.Win32.Qvod.pkl.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Worm.Win32.Qvod.pkl.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:436

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs
1⤵
PID:1772

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3544

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5412

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:260

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4584

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5784

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2236

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4296

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1712

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4732

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3428

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fastuserswitchingcompatibility.dll

Path \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll
Size 139KB
SHA256 4720337f0082c79e57859a813e90bc487b2de47e6fc88ad2f7840795ce0cfa74
MD5 34ae1ed557d44639759f4a697c28234e
SHA1 129aa501d173e48c63c2df41a81410d4bc1fae19
SHA512 15c54999ca156bff78927f03b49ae12c5d29a55d8e605e8b4972b90d531b38fa4b6636025fb02735a29999781499e0ddde72d371f67d8f0d910322001c9a8275
SSDEEP 3072:TH+Mcv5JXXieDEzAEy1W7rkD+bnAIhRQaNZ:THl0ndEEJgkCAaRTb
TLSH
T111E39E729541E873C24601726122AB6F1EA96F371778ECAFC7505AC93EF92E2D230357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-17-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/436-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/436-13-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1712-40-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2236-32-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2492-56-0x00000000008B0000-0x00000000008D3000-memory.dmp

Download

memory/2492-57-0x00000000008B0000-0x00000000008D3000-memory.dmp

Download

memory/2492-55-0x00000000008B0000-0x00000000008D3000-memory.dmp

Download

memory/2864-5-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3428-50-0x0000000000F10000-0x0000000000F33000-memory.dmp

Download

memory/3428-49-0x0000000000F10000-0x0000000000F33000-memory.dmp

Download

memory/3544-9-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4296-36-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4584-22-0x0000000000BB0000-0x0000000000BD3000-memory.dmp

Download

memory/4584-23-0x0000000000BB0000-0x0000000000BD3000-memory.dmp

Download

memory/4732-44-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5784-27-0x0000000000B20000-0x0000000000B43000-memory.dmp

Download