Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
24/04/2026, 22:25
General
- Target spools.ps1
- Size 2.2MB
- Sample260424-2casdaet2m
- SHA256 2d6140fd8a72fdbe19be8071f4b7a39a582edc970694a924d49d7a9ae06fbf72
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\spools.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3najd4c5\3najd4c5.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE445.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF187C209FC694E75A671F49C60EC9B28.TMP"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\wecutil.exe"C:\Windows\System32\wecutil.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RESE445.tmp
Temp_af5cab02c7644cf5a9bbd746aead99e5.dll
__PSScriptPolicyTest_3imcxvfx.ju2.ps1
3najd4c5.0.cs
3najd4c5.cmdline
CSCF187C209FC694E75A671F49C60EC9B28.TMP
memory/1184-26-0x00000252784B0000-0x0000025278626000-memory.dmp
memory/1184-71-0x00000252784A0000-0x00000252784A8000-memory.dmp
memory/1184-77-0x0000025277820000-0x000002527782C000-memory.dmp
memory/1184-2-0x0000025277EF0000-0x0000025277F12000-memory.dmp
memory/1184-76-0x0000025275D90000-0x0000025275F3C000-memory.dmp
memory/1184-1-0x0000025277800000-0x0000025277810000-memory.dmp
memory/1184-0-0x0000025277800000-0x0000025277810000-memory.dmp
memory/1184-25-0x0000025277F80000-0x0000025277F88000-memory.dmp
memory/1184-65-0x0000025278630000-0x000002527864C000-memory.dmp
memory/1184-27-0x0000025278840000-0x0000025278A4A000-memory.dmp
memory/1184-34-0x0000025278680000-0x00000252786C6000-memory.dmp
memory/1184-73-0x0000025278790000-0x000002527879A000-memory.dmp
memory/1184-72-0x0000025278670000-0x0000025278676000-memory.dmp
memory/1184-9-0x0000025277800000-0x0000025277810000-memory.dmp
memory/1184-70-0x00000252787B0000-0x00000252787CA000-memory.dmp
memory/1184-69-0x0000025278490000-0x000002527849A000-memory.dmp
memory/1184-68-0x0000025278650000-0x000002527866C000-memory.dmp
memory/1184-67-0x0000025278480000-0x000002527848A000-memory.dmp
memory/1184-66-0x00000252786D0000-0x0000025278783000-memory.dmp
memory/1184-44-0x0000025277800000-0x0000025277810000-memory.dmp
memory/1184-43-0x0000025277800000-0x0000025277810000-memory.dmp
memory/1184-46-0x0000025277820000-0x000002527782C000-memory.dmp
memory/1184-48-0x0000025277800000-0x0000025277810000-memory.dmp
memory/1184-47-0x0000025277E90000-0x0000025277EA2000-memory.dmp
memory/1184-45-0x0000025275D90000-0x0000025275F3C000-memory.dmp
memory/5188-22-0x000001E346660000-0x000001E34680C000-memory.dmp
memory/5188-23-0x000001E346440000-0x000001E34644C000-memory.dmp
memory/5276-19-0x000001F531F80000-0x000001F531F8C000-memory.dmp
memory/5332-36-0x000002B130670000-0x000002B13067C000-memory.dmp
memory/5332-37-0x000002B148BE0000-0x000002B148BF2000-memory.dmp
memory/5332-35-0x000002B12EBB0000-0x000002B12ED5C000-memory.dmp
memory/6140-50-0x000002AD77D10000-0x000002AD77EBC000-memory.dmp
memory/6140-40-0x000002AD77C00000-0x000002AD77C40000-memory.dmp
memory/6140-41-0x000002AD77C00000-0x000002AD77C40000-memory.dmp
memory/6140-42-0x000002AD77C00000-0x000002AD77C40000-memory.dmp
memory/6140-39-0x000002AD77C00000-0x000002AD77C40000-memory.dmp
memory/6140-38-0x000002AD77C00000-0x000002AD77C40000-memory.dmp
memory/6140-83-0x000002AD77CE0000-0x000002AD77CEC000-memory.dmp