fca291cf6dd9772baa7f0ff9abf1a6fd437ef448e4e981e1c145d83341c4c162

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__84afcf88f6725d5e71b303d5ec7b22c5.vbs
Size 2KB
Sample260919-kbabsadb69
SHA256 fca291cf6dd9772baa7f0ff9abf1a6fd437ef448e4e981e1c145d83341c4c162
MD5 84afcf88f6725d5e71b303d5ec7b22c5
SHA1 dcaceec323db0ab4ebe710e7fa1e8a5e01fa6249
SHA512 e40987230a40f665b8ec3543fe47004009ac27e15ed5cad7187aefa46b4b3a508fd11aeec369dfb949689d7c9c828fff6c7111d01dc5eb638900fda36dc7be91
TLSH
T19A4141E46F889AFAA330056F318DD6464969E6F2AB305A5042DC8C00BCE4D5AC5B6DDE
MD5 SHA1 SHA512 TLSH

Score

5^/10

defense_evasion execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3300	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4832	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 4832	3300	WScript.exe	90
PID 4832 wrote to memory of 5844	4832	cmd.exe	92

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5844	attrib.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__84afcf88f6725d5e71b303d5ec7b22c5.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\julio.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\system32\attrib.exe
    attrib -r -s -h c:\autoexec.bat
    3⤵
    - Views/modifies file attributes
    PID:5844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autoexec.bat

Path C:\autoexec.bat
Size 661B
SHA256 a200b91678a17ef34daed746e3ec407b032d251b5c26d1bc9d963fede653625d
MD5 c7fcc2e2e6a659d45b71b37226bb6d64
SHA1 771e67e2d0f3a85e2cdf259183a01bc1b4e90c3b
SHA512 063565ef782ff6540b61f82df16553ef0cdea3f89714f1b312e5623b723238aaa5c8e0a6fa2e591eb41ea5b2382ea5a75330d6121a7b4512d3cd493849214fbb
TLSH
T1FF015B8C8AD4C891C07821AF5B4FF7A959DDF2C257244E9117E391D2B00883BD924CA8
MD5 SHA1 SHA512 TLSH

Submit Download

julio.bat

Path C:\julio.bat
Size 167B
SHA256 64ffe3261e6d493bd882f7cdb06b30539261d145ee3aa63d6ed129fed11ed00d
MD5 153b571315d74e1809640ed405e19cf3
SHA1 19a80b0d2bacfda41aadd30a3a5ee7a3a8f07755
SHA512 96922522e0f569f560830116ab8d48e11f36b2963a8cde776f1d4c0820ff9537efe86c664e761e787c9187817f7539837203f2de4fcc998c41be780e3c71ec63
TLSH
T16EC0805403E2DC7FAF50449C4139050D168FD3C57F450E6E0F528095D8C06111104B42
MD5 SHA1 SHA512 TLSH