Analysis
- user interaction
yes - max time kernel
118s - max time network
118s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
19/07/2026, 03:58
Static task
static1
Behavioral task
behavioral1
Sample
winutil (1).ps1
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
300 seconds
General
- Target winutil (1).ps1
- Size 680KB
- Sample260719-ej1wtad12x
- SHA256 921b89d2772df4ac69d66370c3bd7b7f23dd8a569ec5c5ca9039ab7d1bf4cb9c
- MD5 b832b1dd43a9ed81b6de8b064fa7e5b9
- SHA1 fbdaacf160355b47e0b1158519317477ad019a92
- SHA512 84107c498b29c276ecc355c666669507e404d8c066194577dcd7cd395656c6dc91acfbaf7e46a732ced125c4a9ffe479b8407064c37283b2c217dd3d9862e6f0
- SSDEEP 12288:/VX8DqE7IaHsIwateJVcHt/mQtEIRbObovV:qOg
- TLSH T1BAE4F623E954493352B2933AAEA76506FF16027F42111C0979FC914C5FB235F827BFAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 12 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 4444 PowerShell.exe 3 4444 PowerShell.exe 4 4444 PowerShell.exe 5 4444 PowerShell.exe 6 4444 PowerShell.exe 7 4444 PowerShell.exe 9 4444 PowerShell.exe 10 4444 PowerShell.exe 11 4444 PowerShell.exe 12 4444 PowerShell.exe 23 4444 PowerShell.exe 24 4444 PowerShell.exe -
pid Process 4444 PowerShell.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4444 PowerShell.exe 4444 PowerShell.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1880 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4444 PowerShell.exe Token: SeDebugPrivilege 1880 taskmgr.exe Token: SeSystemProfilePrivilege 1880 taskmgr.exe Token: SeCreateGlobalPrivilege 1880 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4444 PowerShell.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe 1880 taskmgr.exe
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\winutil (1).ps1"1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4444
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1880
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2784
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WPF61FD.tmp
- Size 519B
- SHA256 1a81fbfbf0a8efe0a8a9a16f0951e679dbbda131fe014a150176056199968e06
- MD5 81addaa406504038756c8f1613668203
- SHA1 73ab2f7a26b0d500f9837625e5833b620ce03877
- SHA512 17a385fc8e6a2ab66d8fad4e2c3eae27e75fa6341091b929f65541c056e1ddec7a95a4f73f40609745d713aea6e82f83fa8b82f117c5fba71ec5b89727d94b18
- TLSH T1E5F0C0F6C48AAB38CB24AA3E85EA54212C35212448FA890CB63B5190214AA5A71663D8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WPF64D9.tmp
- Size 177B
- SHA256 33a03200b71055b3eafcd46496b977612b1e28f828bdc2eaf1f8c78035ccc6ab
- MD5 18126a7da7532151d7044f1fc21c4115
- SHA1 99f232a444661441b9720b1630d68d10100dc141
- SHA512 f52b37ba74ffe8b43d4a929594cb0acfc9c1b9245fbc5fc3f50c03290a03936acbb85a23a3964b18f99d4732140ead434ad980dc2574198fd11e2ab3676cba56
- TLSH T15AC0C0C30300AC1CC56F021228053324DC3231E241DC28440A0F9935BA010007E0A421
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3z5ajitm.bzm.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH