3058d94d789da7fea33e7e0035dba137c5e7ade9b9dbb590cf0ca47190139933

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Downloader.Win32.Selvice.ba.exe
Size 24KB
Sample261006-pg53vsx16r
SHA256 3058d94d789da7fea33e7e0035dba137c5e7ade9b9dbb590cf0ca47190139933
MD5 40430a5dc00e3ca279999bc6dca7a791
SHA1 2e7b63297ca1476a45209b420d448e8e4303b075
SHA512 b46d3150689f2cce0239c3b2ff61d1ea8b9f52f4f4673f99f5b56afb64290f93a129dc871802821185b8a9e72e317af5e30d84b76570ce2146e0bba9c42c09f3
SSDEEP 384:T801guUPQcHnWjprgox3neC8wteoNYRa235miDUwfBv61B:T801F0QcHWjpnx3neC8wteoNYRa2Jmi4
TLSH
T1F5B25C13C468CD76C99109B013E73EB5495B297C4B8538DFF3C5DA65287A8B1B27A30E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\apphxz.bat	jaffacakes118_Trojan-Downloader.Win32.Selvice.ba.exe
File created	C:\Windows\SysWOW64\kyasyyiwt.bat	jaffacakes118_Trojan-Downloader.Win32.Selvice.ba.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4856	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-Downloader.Win32.Selvice.ba.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan-Downloader.Win32.Selvice.ba.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Downloader.Win32.Selvice.ba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5764	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5764	PING.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5788 wrote to memory of 4856	5788	jaffacakes118_Trojan-Downloader.Win32.Selvice.ba.exe	90
PID 4856 wrote to memory of 5764	4856	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Selvice.ba.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Selvice.ba.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\kyasyyiwt.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apphxz.bat

Path C:\Windows\SysWOW64\apphxz.bat
Size 133B
SHA256 14767d321d7d7cf5665077306cc47c691d22b1034f65aa0f97aa0e3d3ddd05de
MD5 dc71e377e16935a5bcf35a65acf40521
SHA1 201409df5af37f5101217717d2fb2dbaaf8f1a0e
SHA512 376a295a4cd5c3a4a7303934f2986118e78dac588c4a2654e0d9726ac6cd036a32ea08102b41dd002d3fcb4627fcfbe5550fbe4523b2d112f7b9ea1f7e0f2184
TLSH
T16CC02BEF418244584800D063003C4B4FC00004C63B0D3B100312818E41F20AA610B635
MD5 SHA1 SHA512 TLSH

Submit Download

kyasyyiwt.bat

Path C:\Windows\SysWOW64\kyasyyiwt.bat
Size 100B
SHA256 bfdf1ef214ebc942df7dbc694a8bc5527c958b92e7f11a0bf8446a47669c51ff
MD5 9bd0d30057d3939ba9771eba97f3816b
SHA1 ae41e6ae5ae38f115d663010344bdd3f179ee4bc
SHA512 d7848fd98f73beddddeb7bec715855b8aacd6b2e2d0be36f24865bfb47ca35038e65c4fbd6deac72fef97e2fa0786f2f8bd1ff0b31468ada13f0f47bf8b11323
TLSH
T171B0123045EC20F2C010D439408D0A1C032CF09E1D28082800C038C9ED90C0D0F10DFC
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads