Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/09/2026, 22:40
General
- Target jaffacakes118_62b192ba0b79bf3f6a35559280e47c16808240e0232fdda0bfac6f709402e43d.exe
- Size 663KB
- Sample260909-2lnetsbl2y
- SHA256 62b192ba0b79bf3f6a35559280e47c16808240e0232fdda0bfac6f709402e43d
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_62b192ba0b79bf3f6a35559280e47c16808240e0232fdda0bfac6f709402e43d.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_62b192ba0b79bf3f6a35559280e47c16808240e0232fdda0bfac6f709402e43d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Method\TypeName.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe' -Force ; Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe' -Force ; Add-MpPreference -ExclusionProcess 'InstallUtil.exe' -Force ; Add-MpPreference -ExclusionProcess 'RegAsm.exe' -Force ; Add-MpPreference -ExclusionProcess 'MSBuild.exe' -Force ; Add-MpPreference -ExclusionProcess 'aspnet_compiler.exe' -Force ; Add-MpPreference -ExclusionProcess 'AppLaunch.exe' -Force ; Add-MpPreference -ExclusionProcess 'RegSvcs.exe' -Force ; Add-MpPreference -ExclusionProcess 'AddInProcess.exe' -Force ; Add-MpPreference -ExclusionProcess 'TypeName.exe' -Force"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -NoProfile -Command "System.Collections.Generic.List`1[System.String]"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Method\TypeName.exeC:\Users\Admin\AppData\Roaming\Method\TypeName.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\Method\TypeName.exe"C:\Users\Admin\AppData\Roaming\Method\TypeName.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_e15p4lyb.1ce.ps1
TypeName.exe
memory/2668-49-0x00000000015C0000-0x0000000001614000-memory.dmp
memory/3068-22-0x0000028CBD6B0000-0x0000028CBD6D2000-memory.dmp
memory/3068-17-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/3068-52-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/3068-29-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/3068-30-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/3068-32-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/3068-25-0x0000028CBD9E0000-0x0000028CBD9FE000-memory.dmp
memory/3068-27-0x0000028CBDAC0000-0x0000028CBDACA000-memory.dmp
memory/3068-19-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/3068-18-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/3068-26-0x0000028CBDA00000-0x0000028CBDAB2000-memory.dmp
memory/3068-33-0x0000028CA4F99000-0x0000028CA4F9F000-memory.dmp
memory/3068-28-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/3524-43-0x000001D360D00000-0x000001D360D06000-memory.dmp
memory/3524-39-0x000001D360CE0000-0x000001D360CFE000-memory.dmp
memory/3524-40-0x000001D360CC0000-0x000001D360CCA000-memory.dmp
memory/3524-41-0x000001D360D20000-0x000001D360D3C000-memory.dmp
memory/3524-42-0x000001D360CD0000-0x000001D360CD8000-memory.dmp
memory/3524-44-0x000001D360D10000-0x000001D360D1A000-memory.dmp
memory/4212-51-0x0000023E406B0000-0x0000023E40704000-memory.dmp
memory/4316-14-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/4316-1-0x00007FFF2469F000-0x00007FFF246A0000-memory.dmp
memory/4316-5-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/4316-16-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/4316-15-0x000000001D7C0000-0x000000001D814000-memory.dmp
memory/4316-4-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/4316-3-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/4316-13-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/4316-12-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/4316-11-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/4316-10-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/4316-9-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/4316-7-0x000000001CB70000-0x000000001CBBC000-memory.dmp
memory/4316-46-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/4316-47-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/4316-2-0x000000001CA00000-0x000000001CB16000-memory.dmp
memory/4316-0-0x0000000000D30000-0x0000000000DDA000-memory.dmp
memory/4316-8-0x00007FFF24510000-0x00007FFF24EB4000-memory.dmp
memory/4316-6-0x000000001CB20000-0x000000001CB74000-memory.dmp