Analysis
- max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/07/2026, 00:18
General
- Target winutil.ps1
- Size 585KB
- Sample260716-alwbwscx21
- SHA256 a378c26587eca4d1f3984b5b8422a97098a858720cb664a7356e6851ce1319d9
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\winutil.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vajasjj2\vajasjj2.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES70C1.tmp" "c:\Users\Admin\AppData\Local\Temp\vajasjj2\CSCA9654F775481466FB467E7D3E65F5396.TMP"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES70C1.tmp
vajasjj2.dll
CSCA9654F775481466FB467E7D3E65F5396.TMP
vajasjj2.0.cs
vajasjj2.cmdline
memory/3160-13-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-19-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-9-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-10-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-11-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-12-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-16-0x000001E9DCEC0000-0x000001E9DCEDE000-memory.dmp
memory/3160-17-0x000001E9DD260000-0x000001E9DD312000-memory.dmp
memory/3160-0-0x00007FFDFB5AF000-0x00007FFDFB5B0000-memory.dmp
memory/3160-40-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-3-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-20-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-21-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-22-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-23-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-25-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-24-0x000001E9DD4F0000-0x000001E9DD6B2000-memory.dmp
memory/3160-26-0x000001E9DDBF0000-0x000001E9DE118000-memory.dmp
memory/3160-7-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-6-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-5-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-39-0x000001E9DCED0000-0x000001E9DCED8000-memory.dmp
memory/3160-8-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-4-0x000001E9C49D0000-0x000001E9C49F2000-memory.dmp
memory/3160-18-0x000001E9DCEE0000-0x000001E9DCEEA000-memory.dmp
memory/3160-42-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-43-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-44-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-45-0x000001E9DD700000-0x000001E9DD708000-memory.dmp
memory/3160-47-0x000001E9DD810000-0x000001E9DD81E000-memory.dmp
memory/3160-46-0x000001E9DD850000-0x000001E9DD88E000-memory.dmp
memory/3160-48-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-49-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-50-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-52-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-53-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-54-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-51-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-55-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-56-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-57-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-58-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-59-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-60-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-62-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-63-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-64-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp
memory/3160-65-0x00007FFDFB420000-0x00007FFDFBDC4000-memory.dmp