Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/09/2026, 22:21
General
- Target jaffacakes118_2zd8mx.ps1
- Size 1.1MB
- Sample260912-19p3wsba52
- SHA256 10ff116d3f2de99d718737fafaed4ed2068a9debc0b8f555650565bf611a95a7
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2zd8mx.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /i:--type=renderer C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\6xepglmx_3AppXDeploymentClient_6.pfx2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s /i:--type=renderer C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\6xepglmx_3AppXDeploymentClient_6.pfx3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:--type=renderer \"%APPDATA%\Microsoft\SystemCertificates\6xepglmx_3AppXDeploymentClient_6.pfx\"' }) { exit 0 } else { exit 1 }"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe"PowerShell.exe" -NoProfile -NonInteractive -Command -4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\regsvr32.EXE"C:\Windows\system32\regsvr32.EXE" /s /i:--type=renderer "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\6xepglmx_3AppXDeploymentClient_6.pfx"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s /i:--type=renderer "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\6xepglmx_3AppXDeploymentClient_6.pfx"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\regsvr32.EXE"C:\Windows\system32\regsvr32.EXE" /s /i:--type=renderer "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\6xepglmx_3AppXDeploymentClient_6.pfx"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s /i:--type=renderer "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\6xepglmx_3AppXDeploymentClient_6.pfx"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_n3rjk5xv.cnv.ps1
6xepglmx_3AppXDeploymentClient_6.pfx
memory/692-9-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/692-8-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/692-0-0x00007FF84A94F000-0x00007FF84A950000-memory.dmp
memory/692-10-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/692-6-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/692-13-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/692-5-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/692-4-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/692-3-0x0000023169FE0000-0x000002316A002000-memory.dmp
memory/3768-25-0x0000000005910000-0x0000000005C6B000-memory.dmp
memory/3768-34-0x00000000070F0000-0x0000000007193000-memory.dmp
memory/3768-21-0x00000000050F0000-0x0000000005156000-memory.dmp
memory/3768-22-0x0000000005160000-0x00000000051C6000-memory.dmp
memory/3768-20-0x0000000005050000-0x0000000005072000-memory.dmp
memory/3768-19-0x0000000074650000-0x0000000074E0C000-memory.dmp
memory/3768-17-0x0000000074650000-0x0000000074E0C000-memory.dmp
memory/3768-27-0x0000000005E10000-0x0000000005E2E000-memory.dmp
memory/3768-28-0x0000000005E70000-0x0000000005EBC000-memory.dmp
memory/3768-29-0x0000000006E00000-0x0000000006E36000-memory.dmp
memory/3768-30-0x0000000070960000-0x00000000709AC000-memory.dmp
memory/3768-16-0x00000000025E0000-0x0000000002616000-memory.dmp
memory/3768-33-0x0000000006420000-0x0000000006440000-memory.dmp
memory/3768-18-0x0000000005200000-0x000000000584A000-memory.dmp
memory/3768-35-0x0000000007860000-0x0000000007EDC000-memory.dmp
memory/3768-36-0x0000000007210000-0x000000000722A000-memory.dmp
memory/3768-37-0x0000000007280000-0x000000000728A000-memory.dmp
memory/3768-38-0x0000000007480000-0x0000000007516000-memory.dmp
memory/3768-39-0x0000000007410000-0x0000000007421000-memory.dmp
memory/3768-41-0x0000000074650000-0x0000000074E0C000-memory.dmp
memory/3768-15-0x0000000074662000-0x0000000074663000-memory.dmp
memory/4348-50-0x00000000051F0000-0x0000000005246000-memory.dmp
memory/4348-51-0x00000000053A0000-0x0000000005464000-memory.dmp
memory/4532-44-0x0000000005B10000-0x0000000005E6B000-memory.dmp
memory/4532-46-0x0000000070960000-0x00000000709AC000-memory.dmp