Analysis
- max time kernel
148s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
22/10/2026, 20:11
General
- Target Jouer.cmd
- Size 669B
- Sample261022-yyefxabd85
- SHA256 1e682c43526392047f262f39651a815b5a367facd6ac00809fc77428da9b5fd9
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 43 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Jouer.cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650012⤵
-
-
C:\Users\Admin\AppData\Local\Temp\flashplayer.exe"C:\Users\Admin\AppData\Local\Temp\flashplayer.exe" "C:\Users\Admin\AppData\Local\Temp\bin\boufbowl-client-1.9.6.swf"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
boufbowl-client.cfg
BoufbowlBackend_Local_Player_https___boufbowl-fan_fr_api_.sol
BoufbowlClient.sol
settings.sxx
settings.sxx
settings.sxx
RevocationCacheFile.dat
memory/5468-3527-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3528-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3662-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3661-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3660-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3659-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3658-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3657-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3656-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3654-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3653-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3650-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3649-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3648-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3647-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3646-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3644-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3643-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3642-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3641-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3640-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3639-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3638-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3637-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3635-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3633-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3632-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3631-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3630-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3629-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3628-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3626-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3625-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3623-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3622-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3620-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3619-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3618-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3617-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3616-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3613-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3611-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3664-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3667-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3666-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3610-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3608-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3655-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3636-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3627-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3624-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3621-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3615-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3612-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3609-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3668-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3672-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3673-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3674-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3676-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3679-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3678-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3677-0x00000000044F0000-0x00000000046F0000-memory.dmp
memory/5468-3675-0x00000000044F0000-0x00000000046F0000-memory.dmp