Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 19:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe
- Size 264KB
- Sample260925-ycc1ysws2n
- SHA256 d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e
- MD5 174188cbe416e4c77741c0e4b8bdab0e
- SHA1 61b9b82845cb2ffc9e3c6a9be5b2716e45adb55a
- SHA512 d2c618a9df9149039a414d5ce84f615a96bd8aaf91920ad5fb592cc0b438154d68bee0281810a362b2ca86540acf98e35176854972434f4eb942297c2fe3d0b3
- SSDEEP 3072:FRjOx1fAIPXwQQ8dZWindy/qed0lH427tPrlUw59bYnrCQvOcL5MtBML4MPr5Ism:Tyx1ocXvW4yCea465/PYnJOcLavYXD
- TLSH T173449D1377E189B1E0B3263409B29B65A776FC308A32DA5B6380774E2D39BD15D39363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\Userinit.exe,C:\\Program Files\\Common Files\\System\\secuers32.exe" jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\drivers\secdrv.sys jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe - Executes dropped EXE 2 IoCs
pid Process 1120 secuers32.exe 3296 server32.exe - Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files\Common Files\System\server32.exe jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe File opened for modification C:\Program Files\Common Files\System\secuers32.exe jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe File opened for modification C:\Program Files\Common Files\System\server32.exe jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe File created C:\Program Files\Common Files\System\Smars.sys jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe File opened for modification C:\Program Files\Common Files\System\Smars.sys jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe File created C:\Program Files\Common Files\System\secuers32.exe jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created \??\c:\windows\inf\icuc32.dll jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe File opened for modification \??\c:\windows\inf\icuc32.dll jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language secuers32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctfmon.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe - Suspicious behavior: LoadsDriver 5 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe Token: SeDebugPrivilege 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe Token: SeDebugPrivilege 1120 secuers32.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 1120 secuers32.exe 1120 secuers32.exe 3296 server32.exe 3296 server32.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3748 wrote to memory of 1120 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 90 PID 3748 wrote to memory of 3296 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 91 PID 3748 wrote to memory of 476 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 92 PID 3748 wrote to memory of 3252 3748 jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe 64 PID 1120 wrote to memory of 6076 1120 secuers32.exe 94
Processes
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;1⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Program Files\Common Files\System\secuers32.exe"C:\Program Files\Common Files\System\secuers32.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\system32\ctfmon.exe"3⤵
- System Location Discovery: System Language Discovery
PID:6076
-
-
-
C:\Program Files\Common Files\System\server32.exe"C:\Program Files\Common Files\System\server32.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3296
-
-
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\system32\ctfmon.exe"2⤵
- System Location Discovery: System Language Discovery
PID:476
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\secuers32.exe
- Size 264KB
- SHA256 d8a8c59ede3e5fdd7c75aa453bfad477950de8fbbab0c4d6459019d82030b14e
- MD5 174188cbe416e4c77741c0e4b8bdab0e
- SHA1 61b9b82845cb2ffc9e3c6a9be5b2716e45adb55a
- SHA512 d2c618a9df9149039a414d5ce84f615a96bd8aaf91920ad5fb592cc0b438154d68bee0281810a362b2ca86540acf98e35176854972434f4eb942297c2fe3d0b3
- SSDEEP 3072:FRjOx1fAIPXwQQ8dZWindy/qed0lH427tPrlUw59bYnrCQvOcL5MtBML4MPr5Ism:Tyx1ocXvW4yCea465/PYnJOcLavYXD
- TLSH T173449D1377E189B1E0B3263409B29B65A776FC308A32DA5B6380774E2D39BD15D39363
- MD5 SHA1 SHA512 SSDEEP TLSH