2d0ff327722cec918fd65579d49baf46c6705b76e1906f3329ed62a08f069981

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/09/2026, 23:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__d33881c7e9d4c70467e00867707bea42.bat
Size 1KB
Sample260917-3wplba1eph
SHA256 2d0ff327722cec918fd65579d49baf46c6705b76e1906f3329ed62a08f069981
MD5 d33881c7e9d4c70467e00867707bea42
SHA1 67616e87754a2b7d3a77d64089c2b0bb808d0934
SHA512 2e222018516501edd9d4455a736e32a1359358cbf67f2f6773c496ba8c9bac2b4e14c05b6380b675439e8d9b41bfbb6c411f04ea44b18c924da3312046bb8a62
TLSH
T1092102FE1DC20B928413684BF51BA6E565E5F2D6AFB34C82C6624EDB6530482F1C7C13
MD5 SHA1 SHA512 TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2240	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2108	2240	cmd.exe	88
PID 2240 wrote to memory of 2816	2240	cmd.exe	89
PID 2240 wrote to memory of 4944	2240	cmd.exe	90

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2108	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__d33881c7e9d4c70467e00867707bea42.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\system32\attrib.exe
  attrib -h C:\Windows\win32.dll
  2⤵
  - Views/modifies file attributes
  PID:2108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" exit"
  2⤵
  PID:2816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" cls"
  2⤵
  PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads