53ee5c38352918d03ed092980f0113d2bdd3bb3857bd1163b609e6f82d4556db

Analysis

max time kernel
148s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__2f56a1f6aeec54ce0996964f51176934.bat
Size 2KB
Sample260919-3fm3jszvb1
SHA256 53ee5c38352918d03ed092980f0113d2bdd3bb3857bd1163b609e6f82d4556db
MD5 2f56a1f6aeec54ce0996964f51176934
SHA1 bf72c8db545b47230636fe5ea312fa825f37d304
SHA512 585da200bd05a13fe117a8097ac9576bae0030a956be7d17fc0452b455d57c42777a4dbfd9d1d9353f8499139a85308a30ade25b258b99cc198492e3b8161695
TLSH
T10341D4EF09852EE391642A46BA6DFD9F315AF0D2B6F4453C852018863150AE41DF9D3D
MD5 SHA1 SHA512 TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5960	cmd.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 4628	5960	cmd.exe	90
PID 5960 wrote to memory of 1800	5960	cmd.exe	91
PID 5960 wrote to memory of 5548	5960	cmd.exe	92
PID 5960 wrote to memory of 5228	5960	cmd.exe	93
PID 5960 wrote to memory of 5844	5960	cmd.exe	94
PID 5960 wrote to memory of 4392	5960	cmd.exe	95
PID 5960 wrote to memory of 1012	5960	cmd.exe	96
PID 5960 wrote to memory of 1296	5960	cmd.exe	97
PID 5960 wrote to memory of 3500	5960	cmd.exe	98
PID 5960 wrote to memory of 5812	5960	cmd.exe	99

Views/modifies file attributes 1 TTPs 10 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4628	attrib.exe
5844	attrib.exe
1012	attrib.exe
1296	attrib.exe
3500	attrib.exe
5812	attrib.exe
1800	attrib.exe
5548	attrib.exe
5228	attrib.exe
4392	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2f56a1f6aeec54ce0996964f51176934.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\system32\attrib.exe
  ATTRIB -H -S +R C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2f56a1f6aeec54ce0996964f51176934.bat.BAT
  2⤵
  - Views/modifies file attributes
  PID:4628
- C:\Windows\system32\attrib.exe
  ATTRIB -H -R -S HELLOTMP.BAT
  2⤵
  - Views/modifies file attributes
  PID:1800
- C:\Windows\system32\attrib.exe
  ATTRIB -H -R -S HELLOTEM.BAT
  2⤵
  - Views/modifies file attributes
  PID:5548
- C:\Windows\system32\attrib.exe
  ATTRIB -H -S C:\AUTOEXEC.BAT
  2⤵
  - Views/modifies file attributes
  PID:5228
- C:\Windows\system32\attrib.exe
  ATTRIB -H -S C:\Windows\WINSTART.BAT
  2⤵
  - Views/modifies file attributes
  PID:5844
- C:\Windows\system32\attrib.exe
  ATTRIB -H -S \WINSTART.BAT
  2⤵
  - Views/modifies file attributes
  PID:4392
- C:\Windows\system32\attrib.exe
  ATTRIB +R jaffacakes118__2f56a1f6aeec54ce0996964f51176934.bat
  2⤵
  - Views/modifies file attributes
  PID:1012
- C:\Windows\system32\attrib.exe
  ATTRIB +R C:\AUTOEXEC.BAT
  2⤵
  - Views/modifies file attributes
  PID:1296
- C:\Windows\system32\attrib.exe
  ATTRIB +R \WINSTART.BAT
  2⤵
  - Views/modifies file attributes
  PID:3500
- C:\Windows\system32\attrib.exe
  ATTRIB +R C:\Windows\WINSTART.BAT
  2⤵
  - Views/modifies file attributes
  PID:5812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HELLOTMP.BAT

Path C:\Users\Admin\AppData\Local\Temp\HELLOTMP.BAT
Size 263B
SHA256 8cffacf7d75162f0af28bb29feda87f987f22a66dbbdbb80eef18ffeb272c626
MD5 af1e09fc328ab24108cb328e168485f1
SHA1 1442ae881da19512c6ea668f902cd793fc4a2580
SHA512 12bf151513334d900e54e38a5ccd617755ea6dd9d1ad97f846d1b28d2e5f5031efe45e552f4b66c5a729e120039bd9bb151929f682a0ddc1f7cc8762f0ce2c85
TLSH
T1FDD02BF7C7CFBC5DEA0867031CE47D09A1CCC408EEA365320338000511009147061C0E
MD5 SHA1 SHA512 TLSH

Submit Download