cc0c8dafb21f2ae80b6af2863211ff6c914e28911f2a5d7288ecf3dc41d50558

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Downloader.Win32.Selvice.mz.exe
Size 24KB
Sample261006-pg9q2sa15p
SHA256 cc0c8dafb21f2ae80b6af2863211ff6c914e28911f2a5d7288ecf3dc41d50558
MD5 5c3235a4357f65bea5aa3bce0b8d03b8
SHA1 a5ee76b5b648ecde1f0f37c48d175ea7e85e043f
SHA512 5213c8f1c4ec3c84f73c5468191de602e59162b3bbc4fb0c148dabb7cb832c497116274fe0cfb2344ef1cbe21dc59340f738cebf7c4c21a9f60dab8f436537c2
SSDEEP 384:f4t2qmIrCtNflbpWoXByVTl2M+8S02JY4FbQlIRB312:f4t2qmI+tNflbpWoXByVB2MI02JY4FZt
TLSH
T16BB24C1388B9CB72D9854D70139D3E724A9B78A41E4679CFF3C0DAB144F597562EA00F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rpagwe.bat	jaffacakes118_Trojan-Downloader.Win32.Selvice.mz.exe
File created	C:\Windows\SysWOW64\oywmkblzl.bat	jaffacakes118_Trojan-Downloader.Win32.Selvice.mz.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1528	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-Downloader.Win32.Selvice.mz.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan-Downloader.Win32.Selvice.mz.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Downloader.Win32.Selvice.mz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4792	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4792	PING.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 1528	4340	jaffacakes118_Trojan-Downloader.Win32.Selvice.mz.exe	89
PID 1528 wrote to memory of 4792	1528	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Selvice.mz.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Selvice.mz.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\oywmkblzl.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

oywmkblzl.bat

Path C:\Windows\SysWOW64\oywmkblzl.bat
Size 100B
SHA256 591d7a21db7f332c78de6c21dc42a1fac0dcac55e9d97f40a23165134fcb1932
MD5 ce0435e30011751e7f8d28ca4b09cba2
SHA1 e970a78f274087005c7a4dc45ba2a6c87fb145d1
SHA512 dbbff08e4b761c6ce72e14ec5a3b40e55ccf250eefcc0274aec46adac59119d0cccfbed224f535534f066d1d4b6495ed2eb8382791013223dc366ee3ae28141b
TLSH
T1FBB012074A7020E0D811C67B523D07A0213CF8A71280052060C024E5EC2080F0E14DFC
MD5 SHA1 SHA512 TLSH

Submit Download

rpagwe.bat

Path C:\Windows\SysWOW64\rpagwe.bat
Size 133B
SHA256 b9e173461a3cc627ebeeb21cdf5019311d6fdb55d28286f99a28e69088813e3c
MD5 4d40ad9a1d20421299636c146840bd86
SHA1 963254900c586b5e0599d7418637bf3a6e88fc15
SHA512 f71239b6af1f06c958d98d3d217196e569952f41365c34a725251d42ad3043d3115595aa62f75d84de7480bc0da7aad9a9401037750c39b415b16af0a10a6ea2
TLSH
T127C02B9F408244984840D063003C4F0FC00004823B0D3B100312818E42F206A5107615
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads