3351e44d8a8225cf167623646a05af58622a4cf87a108fe30075aebc49b3220a

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__952384c3535cbd1dcdbcf864bfa917d0.bat
Size 1KB
Sample260919-qerm5aff92
SHA256 3351e44d8a8225cf167623646a05af58622a4cf87a108fe30075aebc49b3220a
MD5 952384c3535cbd1dcdbcf864bfa917d0
SHA1 f1e9b642531a7ba26955b74ee91b405a53b0f701
SHA512 14799dc738eb4f5253e3c626d485612dad9ba6c10d7b54e5905e8ac673044eccfebea831aa24b2b8e860a62e83b0f1a98478d4a2e8d84179ad2544f44e70e288
TLSH
T122215A477AEE6DC594EE5C692A1CA014E58F98CA4101052479FB2CE7CD641BAC335EF3
MD5 SHA1 SHA512 TLSH

Score

6^/10

execution

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	WScript.exe
File opened (read-only)	\??\H:	WScript.exe
File opened (read-only)	\??\N:	WScript.exe
File opened (read-only)	\??\Q:	WScript.exe
File opened (read-only)	\??\R:	WScript.exe
File opened (read-only)	\??\U:	WScript.exe
File opened (read-only)	\??\V:	WScript.exe
File opened (read-only)	\??\G:	WScript.exe
File opened (read-only)	\??\K:	WScript.exe
File opened (read-only)	\??\L:	WScript.exe
File opened (read-only)	\??\M:	WScript.exe
File opened (read-only)	\??\W:	WScript.exe
File opened (read-only)	\??\Y:	WScript.exe
File opened (read-only)	\??\Z:	WScript.exe
File opened (read-only)	\??\E:	WScript.exe
File opened (read-only)	\??\J:	WScript.exe
File opened (read-only)	\??\O:	WScript.exe
File opened (read-only)	\??\P:	WScript.exe
File opened (read-only)	\??\S:	WScript.exe
File opened (read-only)	\??\T:	WScript.exe
File opened (read-only)	\??\A:	WScript.exe
File opened (read-only)	\??\I:	WScript.exe
File opened (read-only)	\??\X:	WScript.exe
File opened (read-only)	\??\B:	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
5600	WScript.exe
5308	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2120	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5600	WScript.exe
Token: SeCreatePagefilePrivilege	5600	WScript.exe
Token: 33	4396	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4396	AUDIODG.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 5600	2120	cmd.exe	90
PID 2120 wrote to memory of 5308	2120	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__952384c3535cbd1dcdbcf864bfa917d0.bat"
1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\OPENTRAY.VBS"
  2⤵
  - Enumerates connected drives
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of AdjustPrivilegeToken
  PID:5600
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\dropped.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5308

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004A4 0x00000000000004B0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OPENTRAY.VBS

Path C:\OPENTRAY.VBS
Size 196B
SHA256 ce3199e49709e471b38de6fb4a01154443ccd76e8fb5f180a2b8f5dbe00daeae
MD5 7e9d2c409b0e5c7186758e09e96ca397
SHA1 297ac62b68d846cd4d3dec2a5ea3c3f8ffeb5f8b
SHA512 bdd52b202e89acd60c7d13d686b8b32bbfc107388512920af4e1e6a5f5c21c655fd36e497a9055194d601512c05757f51c4e9b6bfc079e8fe7c11889cdc63980
TLSH
T1B6D0A901A1CAC388B0A22E20B5820020F104C8A68A121004FCADE27F22900B1CF3942A
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dropped.bat

Path C:\dropped.bat
Size 14B
SHA256 6f05f92361e4857b6eba36056396ca2520aaf89c69c2290ce4ad53ca7d1c6e06
MD5 7eb310860351ec2a336c10a2454268ac
SHA1 df2f2591d77c9070da3c9a8db84dd3f8fe35b1db
SHA512 833b86802583deb1e6fb463a8129335763adb550dd47d3b337b3629bec81d8a043ca79373226b300664714fbac2e6eaa9afd8751821fd176a57a70210abbb675
MD5 SHA1 SHA512

Submit Download

dropped.vbs

Path C:\dropped.vbs
Size 44B
SHA256 160eb1cd037b0cfdf86f629f605fcca64d4039724d7d2e63be5df79fa2ef0f02
MD5 1ea7c880729c9f54fb56cc6642fd29a6
SHA1 bde296b3a7c6c94cb9c009b63ddbc3da4f5786d1
SHA512 121c2159c4d6e5604090955b488cdd464e911f8b9be1b6ceee512a9895ea4cf24b1097777b1b1e9661c626140456e63265e3db0fab2e5e501cc65d140f5f1297
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads