2e6f6b33c9e0e6763bae40589c9c43d0be79a36ba8e0bc29ef6e1509b7210ec2

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_2e6f6b33c9e0e6763bae40589c9c43d0be79a36ba8e0bc29ef6e1509b7210ec2.exe
Size 290KB
Sample260910-y2zagsee85
SHA256 2e6f6b33c9e0e6763bae40589c9c43d0be79a36ba8e0bc29ef6e1509b7210ec2
MD5 42c699ee0e1854621e265cfb9a2d2b96
SHA1 41f8b339d27687961bebf58db37d3eec88787445
SHA512 0b84181756a8f6938a5ff0285c10d85382040821f6e9f35596589cb31f0513836e26109c6b089f46f02c507436ffecf0e1077fc6603512992b7e3929652ee1d9
SSDEEP 3072:bfRbXxsn6slR57cZ6EhE4IQNv8kAeI2yEe28Plq9njUIg9P8W/mrakO+OlOCxFUB:bfRbGY6EDNNAuHe28Pl2ncxl1IR2O
TLSH
T125548D15AAA810FEE977C17CC9428906EB72BC464761E7CF13904AA62F277D09D3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5604	powershell.exe
5604	powershell.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
2368	cmd.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
2368	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5604	powershell.exe
5604	powershell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	5604	powershell.exe
Token: SeIncreaseQuotaPrivilege	5604	powershell.exe
Token: SeSecurityPrivilege	5604	powershell.exe
Token: SeTakeOwnershipPrivilege	5604	powershell.exe
Token: SeLoadDriverPrivilege	5604	powershell.exe
Token: SeSystemProfilePrivilege	5604	powershell.exe
Token: SeSystemtimePrivilege	5604	powershell.exe
Token: SeProfSingleProcessPrivilege	5604	powershell.exe
Token: SeIncBasePriorityPrivilege	5604	powershell.exe
Token: SeCreatePagefilePrivilege	5604	powershell.exe
Token: SeBackupPrivilege	5604	powershell.exe
Token: SeRestorePrivilege	5604	powershell.exe
Token: SeShutdownPrivilege	5604	powershell.exe
Token: SeDebugPrivilege	5604	powershell.exe
Token: SeSystemEnvironmentPrivilege	5604	powershell.exe
Token: SeRemoteShutdownPrivilege	5604	powershell.exe
Token: SeUndockPrivilege	5604	powershell.exe
Token: SeManageVolumePrivilege	5604	powershell.exe
Token: 33	5604	powershell.exe
Token: 34	5604	powershell.exe
Token: 35	5604	powershell.exe
Token: 36	5604	powershell.exe
Token: SeIncreaseQuotaPrivilege	5604	powershell.exe
Token: SeSecurityPrivilege	5604	powershell.exe
Token: SeTakeOwnershipPrivilege	5604	powershell.exe
Token: SeLoadDriverPrivilege	5604	powershell.exe
Token: SeSystemProfilePrivilege	5604	powershell.exe
Token: SeSystemtimePrivilege	5604	powershell.exe
Token: SeProfSingleProcessPrivilege	5604	powershell.exe
Token: SeIncBasePriorityPrivilege	5604	powershell.exe
Token: SeCreatePagefilePrivilege	5604	powershell.exe
Token: SeBackupPrivilege	5604	powershell.exe
Token: SeRestorePrivilege	5604	powershell.exe
Token: SeShutdownPrivilege	5604	powershell.exe
Token: SeDebugPrivilege	5604	powershell.exe
Token: SeSystemEnvironmentPrivilege	5604	powershell.exe
Token: SeRemoteShutdownPrivilege	5604	powershell.exe
Token: SeUndockPrivilege	5604	powershell.exe
Token: SeManageVolumePrivilege	5604	powershell.exe
Token: 33	5604	powershell.exe
Token: 34	5604	powershell.exe
Token: 35	5604	powershell.exe
Token: 36	5604	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 2368	4416	jaffacakes118_2e6f6b33c9e0e6763bae40589c9c43d0be79a36ba8e0bc29ef6e1509b7210ec2.exe	89
PID 2368 wrote to memory of 5604	2368	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2e6f6b33c9e0e6763bae40589c9c43d0be79a36ba8e0bc29ef6e1509b7210ec2.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2e6f6b33c9e0e6763bae40589c9c43d0be79a36ba8e0bc29ef6e1509b7210ec2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\ZURtuZdLJ\" ; Add-MpPreference -ExclusionPath \"C:\Users\""
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\ZURtuZdLJ\" ; Add-MpPreference -ExclusionPath \"C:\Users\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Window

T1564.003

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5604-0-0x00007FFB799CF000-0x00007FFB799D0000-memory.dmp

Download

memory/5604-1-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5604-2-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5604-3-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5604-7-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5604-6-0x000002329F410000-0x000002329F432000-memory.dmp

Download

memory/5604-8-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5604-11-0x00000232B7A40000-0x00000232B7A5E000-memory.dmp

Download

memory/5604-12-0x00000232B7AA0000-0x00000232B7B52000-memory.dmp

Download

memory/5604-14-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5604-13-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5604-15-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5604-16-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5604-17-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5604-19-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5604-18-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5604-20-0x000002329F4D0000-0x000002329F4DA000-memory.dmp

Download

memory/5604-21-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5604-22-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5604-24-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download