9415464f7c1313d94e01a4dc35d66dae93c563c64b5eb2c2e512995eb608a90c

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_9415464f7c1313d94e01a4dc35d66dae93c563c64b5eb2c2e512995eb608a90c.bat
Size 505B
Sample260925-yc91pavfre
SHA256 9415464f7c1313d94e01a4dc35d66dae93c563c64b5eb2c2e512995eb608a90c
MD5 a09a03927610346c6bfabd211c19b96a
SHA1 60f5b3679b81bce84428603d9d0b80f9839fa81b
SHA512 83b53dbbb5b8fd7665bc56e69eebdac7a1ebda6cab42fb6c2f17c64c56a64b30cc942348fc7aaef07ad6618e85d0d2604d0b25173e673f7e17524dab8972c8cf
TLSH
T1D6F09E31261FC7A180A026EC948D844DD6B7C0775898CD00131EC5E880D668C6DEA3FA
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File created	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1712	attrib.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ = "ask433S.exe"	reg.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3560	cmd.exe
5444	cmd.exe
3272	cmd.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
976	reg.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 5444	3560	cmd.exe	91
PID 3560 wrote to memory of 3132	3560	cmd.exe	92
PID 3560 wrote to memory of 976	3560	cmd.exe	93
PID 3560 wrote to memory of 1712	3560	cmd.exe	95
PID 3560 wrote to memory of 3272	3560	cmd.exe	96

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3132	attrib.exe
1712	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9415464f7c1313d94e01a4dc35d66dae93c563c64b5eb2c2e512995eb608a90c.bat"
1⤵
- Drops file in Drivers directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\system32\cmd.exe
  cmd.exe /C C:\Users\Admin\AppData\Local\Temp\video78634.avi
  2⤵
  - Executes a command shell one-liner
  PID:5444
- C:\Windows\system32\attrib.exe
  attrib -A -H -S -R hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:3132
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /ve /d "ask433S.exe" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:976
- C:\Windows\system32\attrib.exe
  attrib +S +H +R hosts
  2⤵
  - Drops file in Drivers directory
  - Sets file to hidden
  - Views/modifies file attributes
  PID:1712
- C:\Windows\system32\cmd.exe
  cmd.exe /C C:\Users\Admin\AppData\Local\Temp\xSkSjs4.exe
  2⤵
  - Executes a command shell one-liner
  PID:3272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 71B
SHA256 be79263ce8c9b8510d6ea94f71c5118e47070a583101bf90745688ee060db06d
MD5 f61f0d7c4e01983efbc4ec4e02405b44
SHA1 bb92703d472402c4183ed1d59898d0351c81daac
SHA512 02a90f3c441be5ef0e51314cfe0154b100ac3a296396966de6a06848fb9693e732383c425152fc83f064b16280b6db04437b40574b463cf8203ffbdc2adcaa45
TLSH
T14AA002D62F29C240C6AEC652A7225000DC72D05341C5CC4F0213DD0C78F690D61E43D5
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads