Analysis
- max time kernel
149s - max time network
159s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/10/2026, 20:11
General
- Target Jouer.cmd
- Size 669B
- Sample261022-yyefxabd85
- SHA256 1e682c43526392047f262f39651a815b5a367facd6ac00809fc77428da9b5fd9
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 43 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Jouer.cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650012⤵
-
-
C:\Users\Admin\AppData\Local\Temp\flashplayer.exe"C:\Users\Admin\AppData\Local\Temp\flashplayer.exe" "C:\Users\Admin\AppData\Local\Temp\bin\boufbowl-client-1.9.6.swf"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
boufbowl-client.cfg
BoufbowlBackend_Local_Player_https___boufbowl-fan_fr_api_.sol
BoufbowlClient.sol
settings.sxx
settings.sxx
settings.sxx
RevocationCacheFile.dat
memory/3796-3605-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3568-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3617-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3569-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3620-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3570-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3606-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3622-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3621-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3618-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3616-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3615-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3614-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3624-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3613-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3611-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3610-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3609-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3608-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3607-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3627-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3625-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3639-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3626-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3667-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3666-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3665-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3664-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3663-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3662-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3661-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3660-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3659-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3658-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3657-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3654-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3653-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3652-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3651-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3650-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3646-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3645-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3647-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3648-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3644-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3641-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3643-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3642-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3640-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3637-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3636-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3632-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3635-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3634-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3633-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3631-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3630-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3629-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3628-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3668-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3670-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3671-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3672-0x0000000005750000-0x0000000005950000-memory.dmp
memory/3796-3674-0x0000000005750000-0x0000000005950000-memory.dmp