a81003c87d2bd9fcf2c28d0f8e094f65b20fda00dc3b74a9f6890e3a6fb2f579

Analysis

max time kernel
59s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 11:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
Size 121KB
Sample261014-nld99scs8x
SHA256 a81003c87d2bd9fcf2c28d0f8e094f65b20fda00dc3b74a9f6890e3a6fb2f579
MD5 47884646cb9f7653447db50b303eabf6
SHA1 5aeceed28794cab004bc707ce5c6ed7aeb512751
SHA512 374ea5a87a9f29167c19dfef8c749a0569795b9688b4360f46232bd3d3659791b1ee9c3e1ddba2e10f644fa04f6d99c4d41df6ef18801e1d57c308cf2f35a9db
SSDEEP 3072:Ya0o6HDkzbJh1qCxW69hd1MMdxPe9N9uA0Fu9TBfErykm:Ya53bJhs0W69hd1MMdxPe9N9uA0Fu9Tz
TLSH
T1A5C32856B2E01198DBB541F6D9921706EB7174721B15A3CF6B7853B31B2B4CA8F3C3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5508	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 5508	4604	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_UDS.DangerousObject.Multi.Generic.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\AD4D.tmp\AD4E.tmp\AD4F.bat C:\Users\Admin\AppData\Local\Temp\jaffacakes118_UDS.DangerousObject.Multi.Generic.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AD4F.bat

Path C:\Users\Admin\AppData\Local\Temp\AD4D.tmp\AD4E.tmp\AD4F.bat
Size 861B
SHA256 f792976e03def8dde57fbe9b3a5d80d9cd22111878ab7b4a7f2da9338cf2eb4a
MD5 3ffb2f763c6b6c901dc9d6f8f664d5d2
SHA1 6c6c8585a65a4edcd4c205fb1e2826d4602177b4
SHA512 07d3c2d2fccc71f84d2236ee9e802cdea36269502b09302ff9065f17259eedf03fb122f7e14b662b28cf34087a44924013128e90577d7ec26dee259f6c11eb0e
TLSH
T1081136783804A17C97E3039334F2565084B9EE025DE239CADED301414F4ABAACF38B56
MD5 SHA1 SHA512 TLSH

Submit Download