04dce01df43dd3f756ce1d2a3a884e82e7433cf788765148fd78ac3ab820a7de

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 15:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__9c9c13cc335d0e7fa06cd37fd4679fe7.bat
Size 6KB
Sample260919-s4bpbasfpf
SHA256 04dce01df43dd3f756ce1d2a3a884e82e7433cf788765148fd78ac3ab820a7de
MD5 9c9c13cc335d0e7fa06cd37fd4679fe7
SHA1 ac3fb6bf95344d9a39c038521563d9385764dd7e
SHA512 7ee16c9de54bc273bcc165ff47aba6872f0de7341d2207503eb24859e666009540dba97b010b290aea25f57914b1cab6a092cfd078cfedc9efbe0c538e123f87
SSDEEP 192:RnzZnwnRtP5Z8n/8sEeHIa03KxwvDIR7qQunzZnwnRtP5T:RJwnf5Z6EeqKxK83uJwnf5T
TLSH
T186D1FE775B45F841443EFFCCDA69D3E8FE320F824B801C07452E3AB891E949DA59741A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

execution

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\startm~1\programs\startup\Peter_Norton_Antivirus_Professional_Edition_2003_Copyrighted_Edition_Since_1980.........................................................................................................................................bat	cmd.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2976	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2016	2976	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9c9c13cc335d0e7fa06cd37fd4679fe7.bat"
1⤵
- Drops file in Windows directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\system32\rundll32.exe
  rundll32.exe keyboard,disable
  2⤵
  PID:2016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads