c84dc4bcbfd3bb6f8c6c5b91f4aa60ab0c72ced88b72f340c0e8016c095657f3

Analysis

max time kernel
63s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_c84dc4bcbfd3bb6f8c6c5b91f4aa60ab0c72ced88b72f340c0e8016c095657f3.exe
Size 36KB
Sample260924-espj5sydrd
SHA256 c84dc4bcbfd3bb6f8c6c5b91f4aa60ab0c72ced88b72f340c0e8016c095657f3
MD5 8c3b501ed3bf2034ac0af91b99201832
SHA1 4b9bd1d9be945c12e78df8a0588df1934fce7948
SHA512 489e16d149e25c1f9e46465aa2ddb25c2bf488bdb25690f99372a25e1dce7f921d6adeabc154e38f9d708910fd79e024d4acfb11a5bf8fe833296f77b9005540
SSDEEP 768:DHh/o+SvbdSa9BI1jcb9OCJi2YjAsvK/uPpzmXFGbGlLtUhUApKm:DHhwRbdoAbYv9BmJLuxKm
TLSH
T191F25C22A640D1F2C85500B517294FBB6C7DE57122288B8BFB999C94DADC7D6E33C21F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
3128	svcxnw32.exe
3380	svcxnw32.exe
3444	svcxnw32.exe
4092	svcxnw32.exe
4864	svcxnw32.exe
4860	svcxnw32.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\IPConfig = "svcxnw32.exe"	svcxnw32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IPConfig = "svcxnw32.exe"	svcxnw32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IPConfig = "svcxnw32.exe"	svcxnw32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IPConfig = "svcxnw32.exe"	svcxnw32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\IPConfig = "svcxnw32.exe"	svcxnw32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\IPConfig = "svcxnw32.exe"	svcxnw32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IPConfig = "svcxnw32.exe"	svcxnw32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IPConfig = "svcxnw32.exe"	jaffacakes118_c84dc4bcbfd3bb6f8c6c5b91f4aa60ab0c72ced88b72f340c0e8016c095657f3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\IPConfig = "svcxnw32.exe"	svcxnw32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\IPConfig = "svcxnw32.exe"	svcxnw32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IPConfig = "svcxnw32.exe"	svcxnw32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\IPConfig = "svcxnw32.exe"	svcxnw32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IPConfig = "svcxnw32.exe"	svcxnw32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\IPConfig = "svcxnw32.exe"	jaffacakes118_c84dc4bcbfd3bb6f8c6c5b91f4aa60ab0c72ced88b72f340c0e8016c095657f3.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svcxnw32.exe	svcxnw32.exe
File created	C:\Windows\SysWOW64\svcxnw32.exe	svcxnw32.exe
File created	C:\Windows\SysWOW64\svcxnw32.exe	jaffacakes118_c84dc4bcbfd3bb6f8c6c5b91f4aa60ab0c72ced88b72f340c0e8016c095657f3.exe
File created	C:\Windows\SysWOW64\svcxnw32.exe	svcxnw32.exe
File created	C:\Windows\SysWOW64\svcxnw32.exe	svcxnw32.exe
File created	C:\Windows\SysWOW64\svcxnw32.exe	svcxnw32.exe
File created	C:\Windows\SysWOW64\svcxnw32.exe	svcxnw32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4324	cmd.exe
3404	cmd.exe
5216	cmd.exe
824	cmd.exe
5256	cmd.exe
4104	cmd.exe
3452	cmd.exe
5956	cmd.exe
3180	cmd.exe
5748	cmd.exe
5384	cmd.exe
5024	cmd.exe
2824	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svcxnw32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svcxnw32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svcxnw32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svcxnw32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_c84dc4bcbfd3bb6f8c6c5b91f4aa60ab0c72ced88b72f340c0e8016c095657f3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svcxnw32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 3128	4360	jaffacakes118_c84dc4bcbfd3bb6f8c6c5b91f4aa60ab0c72ced88b72f340c0e8016c095657f3.exe	89
PID 4360 wrote to memory of 4324	4360	jaffacakes118_c84dc4bcbfd3bb6f8c6c5b91f4aa60ab0c72ced88b72f340c0e8016c095657f3.exe	90
PID 3128 wrote to memory of 3380	3128	svcxnw32.exe	93
PID 3128 wrote to memory of 3180	3128	svcxnw32.exe	94
PID 3380 wrote to memory of 3444	3380	svcxnw32.exe	96
PID 3380 wrote to memory of 3404	3380	svcxnw32.exe	97
PID 3444 wrote to memory of 4092	3444	svcxnw32.exe	99
PID 3444 wrote to memory of 5216	3444	svcxnw32.exe	100
PID 4092 wrote to memory of 4864	4092	svcxnw32.exe	102
PID 4092 wrote to memory of 824	4092	svcxnw32.exe	103
PID 4864 wrote to memory of 4860	4864	svcxnw32.exe	105
PID 4864 wrote to memory of 5748	4864	svcxnw32.exe	106

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c84dc4bcbfd3bb6f8c6c5b91f4aa60ab0c72ced88b72f340c0e8016c095657f3.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c84dc4bcbfd3bb6f8c6c5b91f4aa60ab0c72ced88b72f340c0e8016c095657f3.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\SysWOW64\svcxnw32.exe
  "C:\Windows\system32\svcxnw32.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\SysWOW64\svcxnw32.exe
    "C:\Windows\system32\svcxnw32.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\Windows\SysWOW64\svcxnw32.exe
      "C:\Windows\system32\svcxnw32.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3444
    - - C:\Windows\SysWOW64\svcxnw32.exe
        
        "C:\Windows\system32\svcxnw32.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4092
      - C:\Windows\SysWOW64\svcxnw32.exe
        
        "C:\Windows\system32\svcxnw32.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\SysWOW64\svcxnw32.exe
        
        "C:\Windows\system32\svcxnw32.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:4860
        
        C:\Windows\SysWOW64\svcxnw32.exe
        
        "C:\Windows\system32\svcxnw32.exe"
        8⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\svcxnw32.exe
        
        "C:\Windows\system32\svcxnw32.exe"
        9⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\svcxnw32.exe
        
        "C:\Windows\system32\svcxnw32.exe"
        10⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\svcxnw32.exe
        
        "C:\Windows\system32\svcxnw32.exe"
        11⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\svcxnw32.exe
        
        "C:\Windows\system32\svcxnw32.exe"
        12⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\svcxnw32.exe
        
        "C:\Windows\system32\svcxnw32.exe"
        13⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\svcxnw32.exe
        
        "C:\Windows\system32\svcxnw32.exe"
        14⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\155.bat" "
        14⤵
        Executes a command shell one-liner
        
        PID:5956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\169.bat" "
        13⤵
        Executes a command shell one-liner
        
        PID:3452
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\339.bat" "
        12⤵
        Executes a command shell one-liner
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\607.bat" "
        11⤵
        Executes a command shell one-liner
        
        PID:4104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\298.bat" "
        10⤵
        Executes a command shell one-liner
        
        PID:5024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\465.bat" "
        9⤵
        Executes a command shell one-liner
        
        PID:5384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\786.bat" "
        8⤵
        Executes a command shell one-liner
        
        PID:5256
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\956.bat" "
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5748
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\328.bat" "
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:824
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\964.bat" "
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5216
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\388.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\555.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\977.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

155.bat

Path C:\Users\Admin\AppData\Local\Temp\155.bat
Size 157B
SHA256 e0db0ea7897be54f8c487968230da60ebe2a509166b8d95499c0a839b3740efa
MD5 78065788ba639f4b880dcf779386734a
SHA1 020a23e8994db75794f6a3be460704e5a5676877
SHA512 a873a21cbe73fcd164f77e355c02e01430a42bd7e0c2ba0910445c3570514b58ab08259c6d95ba3bb78466b1f7eda96440b778fb79684c7fb221869c155fa905
TLSH
T1B4C08C8011A00CA4B1601809420A1188978BA1EB29487A3B08211040F5A1019AEBE180
MD5 SHA1 SHA512 TLSH

Submit Download

169.bat

Path C:\Users\Admin\AppData\Local\Temp\169.bat
Size 157B
SHA256 4500ed90fb5cdf966f9102675355ee60792e5800c5e7855550a3c8c9ac8249b3
MD5 87096783a6c8da2aa23e4b32d6b00e84
SHA1 403719d0b5d71a14f8e766aad0362643584ac427
SHA512 2e2740fe19e8847912826f596497ec0c2de94aec57b0563d771c6b766c74e13ce67e89dcb62286a988aa17d4a57b2ed948f81602fd5240a7d1425bcd446e8d54
TLSH
T14EC08C8011A00C95B4601909420A1189938BA1EB2988793A08211044F5A5019AEBE181
MD5 SHA1 SHA512 TLSH

Submit Download

298.bat

Path C:\Users\Admin\AppData\Local\Temp\298.bat
Size 157B
SHA256 6ad16f4fa9988740f9b0fd328ff13e341acc5a5ecaa2a5a1dca9da5eeeff7a03
MD5 f70e1694668f038ac93d8fc92346341a
SHA1 30f7c5dc899a7427b3e50daef512eb4b11293735
SHA512 b3bcbce3ed969f6b9378ed7b1e828e23b3b270c9af2e5cb5ebb3667477cc472891b88144961105540c9b28db92ccf214dae3a0c6282b941be3fc429fd088944e
TLSH
T1E8C02B8001A00CD5F0601819630E11C8D3CFE1EB3988BA3F0C311081F9A101EBEFF180
MD5 SHA1 SHA512 TLSH

Submit Download

328.bat

Path C:\Users\Admin\AppData\Local\Temp\328.bat
Size 157B
SHA256 5831a3fab8cd02ef785662868650cd590a708ef753ae3e76de3b21849b0c9c6f
MD5 dfea3abdde8c675273cbafcf9d308a56
SHA1 b2ec23929cd2da6879168111d1c787049fb43802
SHA512 745202b20982f53a1d6689549a69cf9be63ca0c57f1e0d0da617db3c99cfc609dd6aee9606be92495836484aa13325ef29b27cbcf9146df13d5789f87951910d
TLSH
T15EC08C8001A00C95B0601829524A2188D78BA1EB2948792A09321040F6A1019AEBE680
MD5 SHA1 SHA512 TLSH

Submit Download

339.bat

Path C:\Users\Admin\AppData\Local\Temp\339.bat
Size 157B
SHA256 b16d67ab62849493e991b0b06309c3da0edd306bb6b0f20fccb8da6fcc165fec
MD5 96ebbd021d528f3062c0b7f8c54b659b
SHA1 f1ebc534e105f4f24ddd710c5de08aba6b3d6266
SHA512 7c9f480bea033a32c1abb7686c5f5a4a670aac3e016c9bee9683a4dd804ab6501ed7b9c68276143e10990c2eebe9e2c6a8f3cd417dfb287709ddbb62f1483ff0
TLSH
T169C08C8000A00CD4B0602809421A2988938BA1EB2988792A08321044F5A1019BEBE580
MD5 SHA1 SHA512 TLSH

Submit Download

388.bat

Path C:\Users\Admin\AppData\Local\Temp\388.bat
Size 157B
SHA256 b7bab92f0c6f7938362e0dcf974d14f731bbd19fc43fea5e3633effb5e362c88
MD5 4a8c01f2653ce326fbb9aa2281c4db74
SHA1 aa4a71bbc5a909c4a1346c7ad465f739aedd1291
SHA512 7aba520dd0b019f1261101764d08b74c13857132e57549dcb2194f903583e5b4ddd8efaa1a5c1b941ca59f73ab5f9e53a6086e7f4197b064ffe5311771d2eacf
TLSH
T1BFC08C8001A00CD5B0601819520E2188938BA5EB2948792A09321040F5A102AAEBE580
MD5 SHA1 SHA512 TLSH

Submit Download

465.bat

Path C:\Users\Admin\AppData\Local\Temp\465.bat
Size 157B
SHA256 ff7081b7405738de84a6b38efb925f62edb6231517e7bade4ee18dbd792ac722
MD5 eb3bc4fe3b208ad3669976e1f54244fb
SHA1 b462b2ea87542f81843c83c30c7b6cd706cb2244
SHA512 d40afe34c74d8bc141f9044f297f4277a8115d44269749c001eacd4040da6b2d593df93674166c3dcb50e9352319ceb58908da0e4f559b08fe00a1895bcc2683
TLSH
T163C08C8010A00C95B1601909424A1188938BA1EB2948792A09611040F5A1019AEBE180
MD5 SHA1 SHA512 TLSH

Submit Download

555.bat

Path C:\Users\Admin\AppData\Local\Temp\555.bat
Size 157B
SHA256 fd0b17565357a1d07323de48571c178652393813059b3c2d60625188272c8108
MD5 c07f7ce1bb698182c1385965591e6a61
SHA1 b1b3c8b617d5875253931bdf662b01b513d11374
SHA512 66ba31dc691dd2da89c8ead664200bebf87677fb5c52e655de9d3dfc6b398a9ab1bcd7cb471fb019899a65159e7762e604feb7569c7b622be62466187b73a13e
TLSH
T18CC08C8000A00C94B2601809420A2188938BA1EF29487A2B08211040F5A1019AEBE1C4
MD5 SHA1 SHA512 TLSH

Submit Download

607.bat

Path C:\Users\Admin\AppData\Local\Temp\607.bat
Size 157B
SHA256 43a2eeb48a9f9d56fc8910a53c4475eaa23db9a21a297dc0a4b0a292480328e2
MD5 44df91795e83a0ca51c0864725532760
SHA1 15ed3d5b61640afe1e24f8a573ca012876ee3ecd
SHA512 407f744d04ade6422c4c6ebed19ea904be1490e9c2e6ccd51cc086b33a229f45149291cda038af97ca5b4cfa2c89dee5c586dc178abb1dd2ccb7d89b0d827ac9
TLSH
T1AFC08C8101A10C94B4601809420A1188938BA1EB2A48792E18222040F9A1019AEBE180
MD5 SHA1 SHA512 TLSH

Submit Download

786.bat

Path C:\Users\Admin\AppData\Local\Temp\786.bat
Size 157B
SHA256 aea8486468b22e2e52f5ae47703d7887c056375deb6e30902978cd8b7f2f4a19
MD5 01e4db5af2e67f26b72a24c0829d073f
SHA1 63dff8e01217ef8f2b8cec0545823aec14f22532
SHA512 87616766b047307f74e72e50df238f898b91cba38c32d64e11c6ef85a8073640252a62e26ef0b40abcc94b533365ecd977bfdedeed5df369a3be5513333e514d
TLSH
T144C08C9010A04CE4B060181A424E1188938BA1EB2988792A0822A040F5A1019AEBE280
MD5 SHA1 SHA512 TLSH

Submit Download

956.bat

Path C:\Users\Admin\AppData\Local\Temp\956.bat
Size 157B
SHA256 b56462462d373fee41f901c43a67a3547b7985dc2e0e8136906d2eddb271866c
MD5 56eda63841fcf83f673b15f1a5e96e98
SHA1 24a10cb31bd0b5484231eda46e0a22291aed1e99
SHA512 3a3f7a65518d15af68b5c94e1dacc6202c711b8c1612b5fdd724425b627783984a835cb9b0b9526c6da0b43b00cd1886a30235f257b736486e90a54c0c3a1f3f
TLSH
T122C08C8000A04CD4B0601809420A1188938BA6EB2948792B09225080F5A1019BEBE280
MD5 SHA1 SHA512 TLSH

Submit Download

964.bat

Path C:\Users\Admin\AppData\Local\Temp\964.bat
Size 157B
SHA256 bcd59926a4c29eabacd87c899358fca1bcef6adc774d300e062dd1af9c73b025
MD5 808c2a4dd9fc3e534a4f606faac501cb
SHA1 5e29a8d15f61383894d6a786644941068327ad91
SHA512 138fab8b5459009853766bd1b38423a004d8e3a3071ea4c2236f33e5d6e16de10f752c1fe0899173f5b0039938f2337e21bd64f333cfbd885a96829c11ebf79d
TLSH
T124C02B8100A00CD4F0A01949430E11C9D3CFE1EB39487A3F0D311040F5A101DFEFF181
MD5 SHA1 SHA512 TLSH

Submit Download

977.bat

Path C:\Users\Admin\AppData\Local\Temp\977.bat
Size 325B
SHA256 0b4cdbe42cb7124ddc4030c6f31f5a40d8612d4901ad5b9aad4d963f8af5056e
MD5 8ed01ffa05cc1caf2adc361e24abfcc2
SHA1 10d0455279ebea2d33966450e4a6bf0d6542fae4
SHA512 db7eae30e6442bb8d06f5b0ab9213d4f8de8f2cb314c3c3b8699acce8e4ba65de8731515cd143eaaae48a3a3dc82b0873a335192913c4321f1b9d8425abda117
TLSH
T173E07D47E2924B8D04A0D1FFCD790A4F60A50C6DB6E82F000BB285BD63B302CAB9F300
MD5 SHA1 SHA512 TLSH

Submit Download

svcxnw32.exe

Path C:\Windows\SysWOW64\svcxnw32.exe
Size 36KB
SHA256 c84dc4bcbfd3bb6f8c6c5b91f4aa60ab0c72ced88b72f340c0e8016c095657f3
MD5 8c3b501ed3bf2034ac0af91b99201832
SHA1 4b9bd1d9be945c12e78df8a0588df1934fce7948
SHA512 489e16d149e25c1f9e46465aa2ddb25c2bf488bdb25690f99372a25e1dce7f921d6adeabc154e38f9d708910fd79e024d4acfb11a5bf8fe833296f77b9005540
SSDEEP 768:DHh/o+SvbdSa9BI1jcb9OCJi2YjAsvK/uPpzmXFGbGlLtUhUApKm:DHhwRbdoAbYv9BmJLuxKm
TLSH
T191F25C22A640D1F2C85500B517294FBB6C7DE57122288B8BFB999C94DADC7D6E33C21F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2088-98-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2924-76-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3128-10-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3380-21-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3416-87-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3444-32-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3752-109-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4092-43-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4144-120-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4360-8-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4860-65-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4864-54-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5408-131-0x0000000000400000-0x000000000040C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads