Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 08:37
General
- Target jaffacakes118_8bab6fbed08c3d8d45512b09126dc39bbf02eca8c5a92655baca7ae7dbfb1b4a.ps1
- Size 2.0MB
- Sample260910-kh4tzattez
- SHA256 8bab6fbed08c3d8d45512b09126dc39bbf02eca8c5a92655baca7ae7dbfb1b4a
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8bab6fbed08c3d8d45512b09126dc39bbf02eca8c5a92655baca7ae7dbfb1b4a.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4676-0-0x00007FFEB781F000-0x00007FFEB7820000-memory.dmp
memory/4676-3-0x0000022372330000-0x0000022372352000-memory.dmp
memory/4676-4-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-5-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-6-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-7-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-8-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-9-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-10-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-11-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-12-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-13-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-14-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-15-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-16-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-17-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-18-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-19-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-20-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-21-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-22-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-23-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-24-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-25-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-26-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-27-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-28-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-41-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp
memory/4676-42-0x00007FFEB7690000-0x00007FFEB8034000-memory.dmp