Analysis
- max time kernel
148s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 12:03
General
- Target jaffacakes118_a9d71cfebee4a35d5888341ad01f1074b232f7a555882d8ffa0b08da920226e8.ps1
- Size 72KB
- Sample260910-n8ffvabq2v
- SHA256 a9d71cfebee4a35d5888341ad01f1074b232f7a555882d8ffa0b08da920226e8
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a9d71cfebee4a35d5888341ad01f1074b232f7a555882d8ffa0b08da920226e8.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2760-0-0x00007FFCF55BF000-0x00007FFCF55C0000-memory.dmp
memory/2760-1-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-4-0x000001FC90FE0000-0x000001FC91002000-memory.dmp
memory/2760-5-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-6-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-7-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-8-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-9-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-10-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-11-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-12-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-13-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-16-0x000001FC91070000-0x000001FC9108E000-memory.dmp
memory/2760-18-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-17-0x000001FCA93E0000-0x000001FCA9492000-memory.dmp
memory/2760-19-0x000001FCA94A0000-0x000001FCA94AA000-memory.dmp
memory/2760-20-0x000001FCA94D0000-0x000001FCA94EE000-memory.dmp
memory/2760-21-0x000001FCA94B0000-0x000001FCA94BA000-memory.dmp
memory/2760-22-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-23-0x000001FCA9980000-0x000001FCA999C000-memory.dmp
memory/2760-24-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-26-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-25-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-27-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-28-0x000001FCA94C0000-0x000001FCA94C8000-memory.dmp
memory/2760-29-0x000001FCA94F0000-0x000001FCA94F6000-memory.dmp
memory/2760-30-0x000001FCA9500000-0x000001FCA950A000-memory.dmp
memory/2760-31-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-32-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-33-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-34-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-35-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-36-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-37-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-38-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-39-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-41-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp
memory/2760-43-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp