Analysis
- user interaction
yes - max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/07/2026, 03:32
General
- Target Script-Ware/Script-Ware.exe
- Size 3.9MB
- Sample260730-d3pr8abb82
- SHA256 d8a79dbf8d8e569a5d0ac6aeb393ab9035d4d9965aa0418ea42cf9baec6436b0
Malware Config
Signatures
- ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Script-Ware\Script-Ware.exe"C:\Users\Admin\AppData\Local\Temp\Script-Ware\Script-Ware.exe"1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5636-0-0x000002458BDA0000-0x000002458C180000-memory.dmp
memory/5636-1-0x00000245A6650000-0x00000245A6A8E000-memory.dmp
memory/5636-3-0x00000245A6A90000-0x00000245A6B52000-memory.dmp
memory/5636-2-0x00000245A6640000-0x00000245A6650000-memory.dmp
memory/5636-8-0x000002458DE70000-0x000002458DE7A000-memory.dmp
memory/5636-9-0x00000245A65F0000-0x00000245A65F8000-memory.dmp
memory/5636-10-0x000002458DD40000-0x000002458DD4A000-memory.dmp
memory/5636-7-0x00000245A65D0000-0x00000245A65EA000-memory.dmp
memory/5636-6-0x00000245A65C0000-0x00000245A65C8000-memory.dmp
memory/5636-5-0x000002458DD10000-0x000002458DD38000-memory.dmp
memory/5636-4-0x000002458DCF0000-0x000002458DCFA000-memory.dmp
memory/5636-11-0x00000245A6600000-0x00000245A6618000-memory.dmp
memory/5636-13-0x00000245A6620000-0x00000245A662A000-memory.dmp
memory/5636-14-0x00000245A6C50000-0x00000245A6E6C000-memory.dmp
memory/5636-16-0x00000245A6E80000-0x00000245A6F22000-memory.dmp
memory/5636-15-0x00000245A6E70000-0x00000245A6E7E000-memory.dmp
memory/5636-17-0x00000245A6640000-0x00000245A6650000-memory.dmp
memory/5636-18-0x00000245A6640000-0x00000245A6650000-memory.dmp
memory/5636-19-0x00000245A6640000-0x00000245A6650000-memory.dmp
memory/5636-20-0x00000245A6640000-0x00000245A6650000-memory.dmp
memory/5636-21-0x00000245A6640000-0x00000245A6650000-memory.dmp