Analysis
- max time kernel
148s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
30/07/2026, 06:19
General
- Target Microsoft.WindowsAppRuntime.2_2.2.0.0_x86__8wekyb3d8bbwe.appx
- Size 20.9MB
- Sample260730-g3f2vsvwdx
- SHA256 b02019a4358f5b292bfc0fa54d644e0f6dc57f345db31ca88223e1aee7545e57
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell start shell:AppsFolder\Microsoft.WindowsAppRuntime.2_8wekyb3d8bbwe!1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4180-0-0x00007FFC28D1F000-0x00007FFC28D20000-memory.dmp
memory/4180-3-0x000001F93E390000-0x000001F93E3B2000-memory.dmp
memory/4180-4-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/4180-5-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/4180-6-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/4180-7-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/4180-8-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/4180-9-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/4180-10-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/4180-11-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/4180-12-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/4180-15-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp
memory/4180-14-0x00007FFC28B90000-0x00007FFC29534000-memory.dmp