Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/09/2026, 12:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118__91c6983ec933e4858d35fa334336a496.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__91c6983ec933e4858d35fa334336a496.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target jaffacakes118__91c6983ec933e4858d35fa334336a496.exe
- Size 12KB
- Sample260919-pad1ssfb49
- SHA256 520cc1c8956e24b06ab2fe064fc51a69d5eb98ae350c3973b576119fa2f085de
- MD5 91c6983ec933e4858d35fa334336a496
- SHA1 6ecdf1f9ef03f0a6c20444eb95c4d48416c3e611
- SHA512 27b46147f49c8eef82d89b8571d59090220196b0371c23941b38b1ba55a5d1bc1260703be18f747d931ca1824792b04a2bbbd99271c25fb2f151e490857092bd
- SSDEEP 384:THpafnBrJe9yH4mSMx4HnE4xEZDFZJma9MibJtNKbMrP:THpQBt3D4HV8Dz83ilqAL
- TLSH T1DE42AE0175409F04C6AC8A3CB98BEB382B9E5E56053042D4B1EC7F9EFAF0637BA64450
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\Help\\svchost.exe" jaffacakes118__91c6983ec933e4858d35fa334336a496.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\jpeg.bmp jaffacakes118__91c6983ec933e4858d35fa334336a496.exe File created C:\Windows\SysWOW64\netstat.com jaffacakes118__91c6983ec933e4858d35fa334336a496.exe File opened for modification C:\Windows\SysWOW64\netstat.com jaffacakes118__91c6983ec933e4858d35fa334336a496.exe File created C:\Windows\SysWOW64\spxtexzyqalkxhfsq41ptrq.ini jaffacakes118__91c6983ec933e4858d35fa334336a496.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\regedit.com jaffacakes118__91c6983ec933e4858d35fa334336a496.exe File opened for modification C:\Windows\regedit.com jaffacakes118__91c6983ec933e4858d35fa334336a496.exe File created C:\Windows\Help\svchost.exe jaffacakes118__91c6983ec933e4858d35fa334336a496.exe File opened for modification C:\Windows\Help\svchost.exe jaffacakes118__91c6983ec933e4858d35fa334336a496.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mspaint.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__91c6983ec933e4858d35fa334336a496.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 6092 mspaint.exe 6092 mspaint.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe Token: SeDebugPrivilege 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 6092 mspaint.exe 6092 mspaint.exe 6092 mspaint.exe 6092 mspaint.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4900 wrote to memory of 6092 4900 jaffacakes118__91c6983ec933e4858d35fa334336a496.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__91c6983ec933e4858d35fa334336a496.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__91c6983ec933e4858d35fa334336a496.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\mspaint.exemspaint C:\Windows\system32\jpeg.bmp2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6092
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4732
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Help\svchost.exe
- Size 12KB
- SHA256 520cc1c8956e24b06ab2fe064fc51a69d5eb98ae350c3973b576119fa2f085de
- MD5 91c6983ec933e4858d35fa334336a496
- SHA1 6ecdf1f9ef03f0a6c20444eb95c4d48416c3e611
- SHA512 27b46147f49c8eef82d89b8571d59090220196b0371c23941b38b1ba55a5d1bc1260703be18f747d931ca1824792b04a2bbbd99271c25fb2f151e490857092bd
- SSDEEP 384:THpafnBrJe9yH4mSMx4HnE4xEZDFZJma9MibJtNKbMrP:THpQBt3D4HV8Dz83ilqAL
- TLSH T1DE42AE0175409F04C6AC8A3CB98BEB382B9E5E56053042D4B1EC7F9EFAF0637BA64450
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\jpeg.bmp
- Size 15B
- SHA256 7c3f6a3cf1e9e5cb198895baca81075706ccb1f815fa66ff78c99df1061eda87
- MD5 795f8ec3276673d2fdd1b37015b6d65a
- SHA1 3c7fe7a9def7c094f012d958bb35a33f345bc841
- SHA512 e206ea3dc21e31aad1ff5bfb1b73736ef368f7420920a37a7faee924423a99f25797e28ef4022235dffe8c61e89a3aba88f871f03615fa494331e54391bc205f
- MD5 SHA1 SHA512
