86380652b8f44fe7d217722a06a41c68ae19fe3311780a76b9a0cfe1c29f999b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.Win32.Orcus.np.exe
Size 989KB
Sample261012-l2v7lsbe27
SHA256 86380652b8f44fe7d217722a06a41c68ae19fe3311780a76b9a0cfe1c29f999b
MD5 55ae3963d3d9111647f466e72505f09a
SHA1 78ad34efe118e8f003f54cb840cbcb9a5870099f
SHA512 b31969f4f24f33dc0574dba633f751c5609659a815fd419312acecea08ca408d6cee40aed2bb73170814efe1d5ed8c2806b999c648857052157fa5a0e8954dbe
SSDEEP 24576:ODSAXt3rpQldN3YpAKg+ykQwL1cc9n2brRaa2NtFpevD7km:qbpON3YWB+ykQwZG0a2N3m7km
TLSH
T100252309E54A41E9C872C4720CBF4CFD1635E756E821DC7FC992DC61992228B7B23B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan-Spy.Win32.Orcus.np.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\secureapps.bAGyz9jLQhCCB6qC.lnk	secureapps.exe

Executes dropped EXE 2 IoCs

pid	Process
2252	secureapps.exe
4068	secureapps.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	secureapps.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	secureapps.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2252 set thread context of 4068	2252	secureapps.exe	100

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	secureapps.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	secureapps.exe
File opened for modification	C:\Windows\assembly	secureapps.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	secureapps.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	secureapps.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.Win32.Orcus.np.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	secureapps.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	secureapps.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	jaffacakes118_Trojan-Spy.Win32.Orcus.np.exe
Token: SeDebugPrivilege	2252	secureapps.exe
Token: SeDebugPrivilege	4068	secureapps.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4068	secureapps.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 4372	2000	jaffacakes118_Trojan-Spy.Win32.Orcus.np.exe	92
PID 3440 wrote to memory of 2252	3440	explorer.exe	94
PID 2252 wrote to memory of 4068	2252	secureapps.exe	100
PID 2252 wrote to memory of 4068	2252	secureapps.exe	100
PID 2252 wrote to memory of 4068	2252	secureapps.exe	100
PID 2252 wrote to memory of 4068	2252	secureapps.exe	100
PID 2252 wrote to memory of 4068	2252	secureapps.exe	100
PID 4068 wrote to memory of 3408	4068	secureapps.exe	101
PID 3408 wrote to memory of 3996	3408	csc.exe	103

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.Orcus.np.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.Orcus.np.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" /c select, C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\secureapps.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4372

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\secureapps.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\secureapps.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\secureapps.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\secureapps.exe"
    3⤵
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - Drops file in Windows directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4068
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xsyztrwr.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3408
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES69EC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC69EB.tmp"
        5⤵
        
        PID:3996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES69EC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES69EC.tmp
Size 1KB
SHA256 2c9aedaa907643f7e9615e6705456594c418e375c80edf79edfe9a8dbfe18e8a
MD5 7b0eec25d1a215786b7517e802954b8d
SHA1 380abb0f05ce8a443de2ba996ff4f80032bc3cbf
SHA512 111930fd34f0bf969a3a61da77bd992fb1b2139aed7882f77805c0fb90734dd4b15c234cf16c3dd99f30fae8b45be125d7639f8bca5b450a9c7a51a86b45efda
TLSH
T12421BA1967E9031AF0B38731B8B513269238FE60DFA2B36E449801292D61500EEA0A77
MD5 SHA1 SHA512 TLSH

Submit Download

xsyztrwr.dll

Path C:\Users\Admin\AppData\Local\Temp\xsyztrwr.dll
Size 76KB
SHA256 87f245c1faff94f2328d25d93c8713d02cd392bda32509b8c786abec83e8a7b4
MD5 e6b9e141c19f818db9a4f0763ee1c793
SHA1 dbe278a484e8c0dc500f137b1f82ef626fd6759f
SHA512 7fd466ccd05775537adb8b68f1121d65048e4c016c4f45cb4bc5205404c3c8a01faa58fe909a4dfa18cf53363f6650e7173e86d223d1c67f50daa95da963dfd3
SSDEEP 768:QbLkKC2fytMzFHOVJx2/0XgpbBU2mKEexRe+Fxds0kKRvrGbESTlVUYnSvYfa8UF:ILtKqeAA/J4gfa8UY21v9bKCHgC/6q
TLSH
T1B7733F4073D62F2AE3BE43F054B12A168FF2B416F85BE2D9ADC460E926E67404DC1F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

secureapps.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\secureapps.exe
Size 989KB
SHA256 86380652b8f44fe7d217722a06a41c68ae19fe3311780a76b9a0cfe1c29f999b
MD5 55ae3963d3d9111647f466e72505f09a
SHA1 78ad34efe118e8f003f54cb840cbcb9a5870099f
SHA512 b31969f4f24f33dc0574dba633f751c5609659a815fd419312acecea08ca408d6cee40aed2bb73170814efe1d5ed8c2806b999c648857052157fa5a0e8954dbe
SSDEEP 24576:ODSAXt3rpQldN3YpAKg+ykQwL1cc9n2brRaa2NtFpevD7km:qbpON3YWB+ykQwZG0a2N3m7km
TLSH
T100252309E54A41E9C872C4720CBF4CFD1635E756E821DC7FC992DC61992228B7B23B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC69EB.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC69EB.tmp
Size 676B
SHA256 5a9e38f6fa04cc28f4659f15dcb83b58ab5e70591c64b6bacc0dd90c37ff59f5
MD5 87adbea2ebfbae2762c24404f9f08656
SHA1 a6fbcb26f8ad3779e360e404ac040a0abec792eb
SHA512 647b50f057e1d289b11642945ce525b8e4df7632c38dca53654dabaf0875a2f64c68c782f614fb1626e2ec471ed4f5a59d4fe58f6da22ef67ca14a9db35cee23
TLSH
T1EA01965867F81229F0F38B30BCF1475391A8BC60DD3673AD1498161A2C70511D665F7B
MD5 SHA1 SHA512 TLSH

Submit Download

xsyztrwr.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xsyztrwr.0.cs
Size 208KB
SHA256 f86d4f06466441ebd23a2ce8f869923c6d135748ac239f442d3dc22cd12bec21
MD5 b85c159fc0c35ea9152aa431bd8257de
SHA1 f155595d1190f6c7fb90aa6610213017578bccd2
SHA512 d8af0eb4696911c3e4fb8eb4cf0dd5bcd4d3c539d311a4df79dc1edd9c83a2e1c78cfa7d9ad8fc4e55944eca87361df1eeaa65169258b05d0c2624c5d3bb9e6c
SSDEEP 6144:1TC1D/f78kFGAv2tAB75TC1D/f78/cvkDcAmM5fQJTDUWK5P7PFTufsWY5/m:dC1rZFGAv2tAB7ZC1rQcvkDcAmM5fQJ7
TLSH
T1652452387100AB1201B763FAD791C987F9768527052EA930BACCC49AEFB84528775F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xsyztrwr.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xsyztrwr.cmdline
Size 347B
SHA256 2ae9a19aef24a7633ce889990f642e03d7bd1cece7de44f6cfc5d41ce99dff02
MD5 40a2f4e53a3a97bebf2e6920cbeec821
SHA1 f728a6caecfc8a5169bc67763c120f641ed59a97
SHA512 3522d5c21ccc02e23e817fb4283c0cc8b9e840bb1ae2c057188f7b6efdda7cde686d720a033d6e0574dd4c425f186e16533476ab0640a24e3d7077046a961acc
TLSH
T1E8E0C00D875AC13201B1321265996B4C42D2960F3D017F2C8640480D21134296EC2BD4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2000-0-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/2000-1-0x0000000074FC2000-0x0000000074FC4000-memory.dmp

Download

memory/2000-2-0x0000000074FC0000-0x0000000075571000-memory.dmp

Download

memory/2000-5-0x0000000074FC0000-0x0000000075571000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads