61c2e0e293226e87c9d149b2304799c064b83051e70e41e1a305159621a0196c

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
readjustService.ps1
Size 23KB
Sample260804-h2zy1sfa87
SHA256 61c2e0e293226e87c9d149b2304799c064b83051e70e41e1a305159621a0196c
MD5 5bd7ee9dec279d1932c3af0473c4dba5
SHA1 2af3b111d0333e716f2f9a31042f64f2acd0d333
SHA512 59d442e83c83cf632b27d9043f1248b002bf46beaf3ebd8af2f1b72cec65d8b56ce1d922d377d4da71a176f87a67cd77dee2b37ac97cce899007655a01ffb4af
SSDEEP 384:bxslEuM3NtqpQsfj38y0rr+Yw3plKTlSgSb:bxUpQ0zFcri3n6lSgc
TLSH
T1E8B272146D4099268BF267289489C57CEF23A1333DA71650F9FC15806FA6424CBBEF7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\WindowsPowerShell\v1.0\WinRing0x64.sys	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4648	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4648	PowerShell.exe
4648	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	PowerShell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 5868	4648	PowerShell.exe	90
PID 5868 wrote to memory of 1376	5868	csc.exe	91

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\readjustService.ps1
1⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uc1yxfhu\uc1yxfhu.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC54F.tmp" "c:\Users\Admin\AppData\Local\Temp\uc1yxfhu\CSCBAC71ECCBB514C4C820DDD1279B6B5.TMP"
    3⤵
    PID:1376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESC54F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC54F.tmp
Size 1KB
SHA256 8d167863165aa9cd16dd42e330de06e692d078a2b7a81c40792bbfdcb412cd73
MD5 e29e17d125bde742345180235635ecb6
SHA1 acccd8e7001ecd9ab77e9b79ad011c593b96bd2f
SHA512 d2744f8c39a8383ee23c3db16cbd045bc0033e775b8c4dc0443bb22eb30415d421a5996f97be38d883751060753e2787b38f1e08ba44c5af58b4461efc6e9095
TLSH
T13421890693F94B0AF07747316AFA072B9239FD69EFA2635A944442282C52504EEE0F72
MD5 SHA1 SHA512 TLSH

Submit Download

uc1yxfhu.dll

Path C:\Users\Admin\AppData\Local\Temp\uc1yxfhu\uc1yxfhu.dll
Size 6KB
SHA256 0db74060b08accba6a29fc13fa930f33f777c48e9367fe510a8647f3638ab1e2
MD5 9be3d9854e6ac131a2a671dac646ebe5
SHA1 3d7eef84b781698bc9ceaf1bb28b99b544a7f38e
SHA512 b62c5dde9f5cafd0333e35b5acb9fa37fe7631e06a323a7ef74bdb8d2a2a6aab5909cdaedf213c32a56d68f84d8f420a6cafba0322dcd9f77b161be340ac1d12
SSDEEP 96:Kue4758hLHL0xawjubPkAw63VRu+SzVK:SY89HL0xawj8w63VuY
TLSH
T190D1101EBF8CC93EC476023455B30F1881F0F699B5929767ABAE501C8CFF58885E1AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCBAC71ECCBB514C4C820DDD1279B6B5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\uc1yxfhu\CSCBAC71ECCBB514C4C820DDD1279B6B5.TMP
Size 652B
SHA256 64da7f14cdfcc243f247e12eb5c137d58d3efc49d606e29042f48f81c3bc7340
MD5 c9efaff0738a6a8016eb1c78042eeaa5
SHA1 b184332d1c80bd7ebbdc320d7750c437b4bdc320
SHA512 f98410413976ecfc41bc636818e25ef885dd49208deb52f2ee3d7815182209d8a8ddb5005f0338b4532a98521cf232531b6be6e52ee86fe606a411d523f6d3c3
TLSH
T16CF03A4963FC420AF5F34B30BAF6436395A9BC69DE3293ED6440032D28649108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

uc1yxfhu.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\uc1yxfhu\uc1yxfhu.0.cs
Size 6KB
SHA256 a880aba85837c89c2130739707448814120940bc031ae04ab29c8f85efaca14c
MD5 f3d00934a25d9c1f3dfcfba1d29aec3f
SHA1 c2fd14ad752cdc856f1041845c1e0916d71885c2
SHA512 449d6bd21e56cfef4636569c64e5a92caf9cd7786cfa15408a05f0a5268d43e70585797555204bac3094cd6795a4b41e32d3d18133fe4a3d31249414149e1114
SSDEEP 96:JjMKKRMmrkkSnAKFNdJx55TjV9jqpszdf:8RMjAWNtqpsJf
TLSH
T132D193682940EA3594E28E48D0CCC6FEE313E17136E72B5056F81B60AF5707591FFA7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uc1yxfhu.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\uc1yxfhu\uc1yxfhu.cmdline
Size 369B
SHA256 cef4b3dff494ab26cda5df3833eccedefe4fac646b5395d8da4d6b87763be9cd
MD5 9d247022a5fac12017d180cb17515103
SHA1 b3191be41dd172cbb7654ac8b2cbfdb2f5214eb6
SHA512 d0d9086e8dc24b7ef7a418e255e12809a5a120f189f161b46cb1973b87d2bb06df3f9b4464679f44b4ea8f40f4d28c77d177cbb7cde2c871a59ad164077994b2
TLSH
T13DE0682A4387CA7E21D9100B21ABC4ECC3724E432E413F886049441DD02700127D2F81
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4648-22-0x00000209F9D70000-0x00000209F9D78000-memory.dmp

Download

memory/4648-8-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/4648-9-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/4648-0-0x00007FFC3D47F000-0x00007FFC3D480000-memory.dmp

Download

memory/4648-6-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/4648-5-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/4648-7-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/4648-3-0x00000209FA3D0000-0x00000209FA3F2000-memory.dmp

Download

memory/4648-4-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/4648-23-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/4648-24-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/4648-25-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download

memory/4648-27-0x00007FFC3D2F0000-0x00007FFC3DC94000-memory.dmp

Download