Analysis
- user interaction
yes - max time kernel
33s - max time network
34s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
24/08/2026, 03:44
General
- Target jaja.ps1
- Size 336KB
- Sample260824-eaz8xssflf
- SHA256 94a83b5b3f8e5d2317a9ce0145d0db99fde1ed2afa7e96101a7ffb5e5734471f
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\jaja.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\esarnbp1\esarnbp1.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES65E9.tmp" "c:\Users\Admin\AppData\Local\Temp\esarnbp1\CSC5775EC21D22B49609C775E804B7A2E8A.TMP"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES65E9.tmp
__PSScriptPolicyTest_xpr25yre.f3t.ps1
esarnbp1.dll
CSC5775EC21D22B49609C775E804B7A2E8A.TMP
esarnbp1.0.cs
esarnbp1.cmdline
memory/1040-23-0x00000226A9F20000-0x00000226A9F30000-memory.dmp
memory/1040-32-0x00000226A9F20000-0x00000226A9F30000-memory.dmp
memory/1040-1-0x00000226A9F20000-0x00000226A9F30000-memory.dmp
memory/1040-22-0x00000226AC560000-0x00000226AC568000-memory.dmp
memory/1040-0-0x00000226A9F20000-0x00000226A9F30000-memory.dmp
memory/1040-24-0x00000226A9F20000-0x00000226A9F30000-memory.dmp
memory/1040-26-0x0000022EB3940000-0x0000022EB40E6000-memory.dmp
memory/1040-27-0x00000226A9F20000-0x00000226A9F30000-memory.dmp
memory/1040-30-0x0000022EB3290000-0x0000022EB3390000-memory.dmp
memory/1040-8-0x00000226ABFA0000-0x00000226ABFC2000-memory.dmp
memory/1040-33-0x00000226A9F20000-0x00000226A9F30000-memory.dmp
memory/1040-34-0x00000226A9F20000-0x00000226A9F30000-memory.dmp
memory/1040-36-0x00000226A9F20000-0x00000226A9F30000-memory.dmp
memory/1040-35-0x00000226AC2D0000-0x00000226AC41E000-memory.dmp
memory/1040-37-0x00000226A9F20000-0x00000226A9F30000-memory.dmp
memory/1040-38-0x00000226A9F20000-0x00000226A9F30000-memory.dmp
memory/1040-41-0x00000226AC2D0000-0x00000226AC41E000-memory.dmp