27b569730fe0705e9ac9b41c2f5428524fb842c1439f5d76df265a70213c01ec

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__28a16f45436d5c5e2c5febbc27cdd30f.bat
Size 2KB
Sample260920-2cv4bafj2s
SHA256 27b569730fe0705e9ac9b41c2f5428524fb842c1439f5d76df265a70213c01ec
MD5 28a16f45436d5c5e2c5febbc27cdd30f
SHA1 5aee6955b77b6dec7403fc6cf378e73ad8e16b8d
SHA512 8068c2b8dede77013a0bda05a0d0fd7518b0fcd14170145ee3083a93b8a07189b1924b7addf9acc9018f3e463e1d78479d6d79b0c3ef66abc29caf83541684d1
TLSH
T1234189ED66D70E5608120D9B417A730FFB9961C7AB060F18336FD9E74020E3C4A16E98
MD5 SHA1 SHA512 TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6108	cmd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6108 wrote to memory of 4832	6108	cmd.exe	90
PID 6108 wrote to memory of 3500	6108	cmd.exe	91
PID 6108 wrote to memory of 1256	6108	cmd.exe	92
PID 6108 wrote to memory of 2536	6108	cmd.exe	93
PID 6108 wrote to memory of 1796	6108	cmd.exe	94
PID 6108 wrote to memory of 4100	6108	cmd.exe	95
PID 6108 wrote to memory of 944	6108	cmd.exe	96

Views/modifies file attributes 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2536	attrib.exe
1796	attrib.exe
4100	attrib.exe
944	attrib.exe
4832	attrib.exe
3500	attrib.exe
1256	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__28a16f45436d5c5e2c5febbc27cdd30f.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6108
- C:\Windows\system32\attrib.exe
  attrib *.bat +r +a
  2⤵
  - Views/modifies file attributes
  PID:4832
- C:\Windows\system32\attrib.exe
  attrib -h -r -s -a
  2⤵
  - Views/modifies file attributes
  PID:3500
- C:\Windows\system32\attrib.exe
  attrib t +r
  2⤵
  - Views/modifies file attributes
  PID:1256
- C:\Windows\system32\attrib.exe
  attrib ????????.bat +r
  2⤵
  - Views/modifies file attributes
  PID:2536
- C:\Windows\system32\attrib.exe
  attrib ????????.bat +r
  2⤵
  - Views/modifies file attributes
  PID:1796
- C:\Windows\system32\attrib.exe
  attrib t +r
  2⤵
  - Views/modifies file attributes
  PID:4100
- C:\Windows\system32\attrib.exe
  attrib *.bat +r +a
  2⤵
  - Views/modifies file attributes
  PID:944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads