4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/02/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
service2.bat
Size 210KB
Sample260223-tktw8aay3d
SHA256 4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343
MD5 ff794a3dcdf6e8c3747c1477551d2509
SHA1 149b54f7f975df668cc22fecf2c14a05f2fe5023
SHA512 dd3cac80df20f1872af52bfa1bb96971eda206b26dcd10e46fef1446ff3eeefb2d9b68ae0b6803f668b019ac433ff30e469db2007fe19ac3b34ce1f7e45dd21c
SSDEEP 6144:GHxMpQ4vfYZueRvh3vuu1YPcFh0AQX0ymPFh:WvWfYEeVh/ukdFhToaf
TLSH
T100240223DC842D6EB76015AB6C092F8222C13574176F7DCF83E1AAE450D7F62770A6B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1640	powershell.exe
1640	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\Control Panel\International\Geo\Nation	winlogon.exe

Executes dropped EXE 2 IoCs

pid	Process
1268	winlogon.exe
1132	winlogon.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
26	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
2984	timeout.exe
1188	timeout.exe
3536	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
1132	winlogon.exe
1640	powershell.exe
1640	powershell.exe
1640	powershell.exe
1640	powershell.exe
1640	powershell.exe
1640	powershell.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe
1132	winlogon.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5720	WMIC.exe
Token: SeSecurityPrivilege	5720	WMIC.exe
Token: SeTakeOwnershipPrivilege	5720	WMIC.exe
Token: SeLoadDriverPrivilege	5720	WMIC.exe
Token: SeSystemProfilePrivilege	5720	WMIC.exe
Token: SeSystemtimePrivilege	5720	WMIC.exe
Token: SeProfSingleProcessPrivilege	5720	WMIC.exe
Token: SeIncBasePriorityPrivilege	5720	WMIC.exe
Token: SeCreatePagefilePrivilege	5720	WMIC.exe
Token: SeBackupPrivilege	5720	WMIC.exe
Token: SeRestorePrivilege	5720	WMIC.exe
Token: SeShutdownPrivilege	5720	WMIC.exe
Token: SeDebugPrivilege	5720	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5720	WMIC.exe
Token: SeRemoteShutdownPrivilege	5720	WMIC.exe
Token: SeUndockPrivilege	5720	WMIC.exe
Token: SeManageVolumePrivilege	5720	WMIC.exe
Token: 33	5720	WMIC.exe
Token: 34	5720	WMIC.exe
Token: 35	5720	WMIC.exe
Token: 36	5720	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5720	WMIC.exe
Token: SeSecurityPrivilege	5720	WMIC.exe
Token: SeTakeOwnershipPrivilege	5720	WMIC.exe
Token: SeLoadDriverPrivilege	5720	WMIC.exe
Token: SeSystemProfilePrivilege	5720	WMIC.exe
Token: SeSystemtimePrivilege	5720	WMIC.exe
Token: SeProfSingleProcessPrivilege	5720	WMIC.exe
Token: SeIncBasePriorityPrivilege	5720	WMIC.exe
Token: SeCreatePagefilePrivilege	5720	WMIC.exe
Token: SeBackupPrivilege	5720	WMIC.exe
Token: SeRestorePrivilege	5720	WMIC.exe
Token: SeShutdownPrivilege	5720	WMIC.exe
Token: SeDebugPrivilege	5720	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5720	WMIC.exe
Token: SeRemoteShutdownPrivilege	5720	WMIC.exe
Token: SeUndockPrivilege	5720	WMIC.exe
Token: SeManageVolumePrivilege	5720	WMIC.exe
Token: 33	5720	WMIC.exe
Token: 34	5720	WMIC.exe
Token: 35	5720	WMIC.exe
Token: 36	5720	WMIC.exe
Token: SeDebugPrivilege	1132	winlogon.exe
Token: SeDebugPrivilege	1132	winlogon.exe
Token: SeDebugPrivilege	1640	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 5720	2872	cmd.exe	89
PID 2872 wrote to memory of 1788	2872	cmd.exe	90
PID 2872 wrote to memory of 4340	2872	cmd.exe	92
PID 2872 wrote to memory of 4112	2872	cmd.exe	93
PID 2872 wrote to memory of 5104	2872	cmd.exe	95
PID 2872 wrote to memory of 840	2872	cmd.exe	96
PID 2872 wrote to memory of 3412	2872	cmd.exe	97
PID 2872 wrote to memory of 1268	2872	cmd.exe	98
PID 2872 wrote to memory of 2984	2872	cmd.exe	99
PID 1268 wrote to memory of 1624	1268	winlogon.exe	100
PID 1624 wrote to memory of 4504	1624	cmd.exe	102
PID 1624 wrote to memory of 1188	1624	cmd.exe	103
PID 1624 wrote to memory of 1132	1624	cmd.exe	106
PID 1624 wrote to memory of 3536	1624	cmd.exe	107
PID 1132 wrote to memory of 3772	1132	winlogon.exe	112
PID 1132 wrote to memory of 5468	1132	winlogon.exe	114
PID 5468 wrote to memory of 1640	5468	cmd.exe	116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\service2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\System32\Wbem\WMIC.exe
  wmic computersystem get manufacturer,model
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5720
- C:\Windows\system32\findstr.exe
  findstr /i "vmware virtualbox qemu xen parallels"
  2⤵
  PID:1788
- C:\Windows\system32\mode.com
  mode con cols=10 lines=1
  2⤵
  PID:4340
- C:\Windows\system32\cscript.exe
  cscript //nologo //e:vbscript "F6xcad_junk.vbs"
  2⤵
  PID:4112
- C:\Windows\system32\cscript.exe
  cscript //nologo //e:vbscript "F6xcad_mem1.vbs"
  2⤵
  PID:5104
- C:\Windows\system32\cscript.exe
  cscript //nologo //e:vbscript "F6xcad_decoder_write.vbs"
  2⤵
  PID:840
- C:\Windows\system32\cscript.exe
  cscript //nologo //e:vbscript "F6xcad.vbs"
  2⤵
  PID:3412
- C:\Users\Admin\AppData\Local\Temp\winlogon.exe
  "winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_2MNXKHDYXEZIcDq3ev0EIsks5tsCBh.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1624
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4504
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1188
  - - C:\Users\Admin\AppData\Roaming\PlatformRuntime\winlogon.exe
      "C:\Users\Admin\AppData\Roaming\PlatformRuntime\winlogon.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1132
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "" /sc ONLOGON /tr "" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3772
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell.exe -NonI -W Hidden -Exec Bypass "Add-MpPreference -ExclusionProcess (Get-Process -Id $PID).Path"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5468
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NonI -W Hidden -Exec Bypass "Add-MpPreference -ExclusionProcess (Get-Process -Id $PID).Path"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3536
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winlogon.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log
Size 859B
SHA256 685f70bf685f654651dcd0acc495b6f52f02f73cc3ca8b3d2c8433aac9ba144d
MD5 e204f3d12abd1691ce1f149399441188
SHA1 798042095539abfe857e456fca4e1035f67d29bf
SHA512 804c5ea57a59f86fd0c34479be4c479230bff79093548e8461758829928969da565c211ccc9cb9befa0fef15f0400a5b1f17d5ddf88aef6ff01b67a191176b9f
TLSH
T1E7116B70227AA1D889162F952C1E2BC403BF4336B650DE0C7998729EED364175F212E7
MD5 SHA1 SHA512 TLSH

Submit Download

F6xcad.tmp

Path C:\Users\Admin\AppData\Local\Temp\F6xcad.tmp
Size 104KB
SHA256 6587304399200f1104087b706ce890bbaa50e680b418f88d603fc0ce355ac586
MD5 d0cab9d8581341441ce865b4ebadb384
SHA1 d96cf25ec439f9cf331c715ac180928ff6e4a502
SHA512 b60ebcc6082dec4868b4b03f48fbf8b2546f9df60a60d0524d5bf247f6793f7c4fe6dff6982ababe8990826eb4e2814bf8b752d4e30f9e953dab66982e0218e9
SSDEEP 1536:WfYoGFdol8WWA1CM3F/zYQ0hpFywroSnCJQpOnrIAynIZbnFcoBaRyPGnFT6:QmCWk4mr0Iwro4CBrhynwFcooRLFO
TLSH
T169A30223ECD8BE3E8C24AF6BCD037E4954862C911B6EB5C7C141C8D913D2E65D54F626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F6xcad.tmp

Path C:\Users\Admin\AppData\Local\Temp\F6xcad.tmp
Size 8KB
SHA256 a02e7faeb0251ffb9a8f52b7f584fa95993fdf4ee6f2654f1410cf74ebd528f5
MD5 8923e73f37ac5dc3caaba66b1bd5893d
SHA1 051ee73b6ab27b824058f38655e4570261ee9110
SHA512 454a5fcfeae84009c79ead605e9be43f33142877de7fad9cb159a66fcb19cd0a9abb44a52d0f62b85ceeaae6b07eb08d963256a681d476c1807e16af056742fd
SSDEEP 192:tDETgaa1WzTUGqRYRWrTbSYfzzTJ7Dtjuow/4t+IhO6Xztbk3vW:BMgaaWflabjz/lDtjVwAwQXztQfW
TLSH
T18D129E1D852047258D306B978A16B8E6E5D769952D0FB54FE0CB4CF19CC3CF226C70AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F6xcad.vbs

Path C:\Users\Admin\AppData\Local\Temp\F6xcad.vbs
Size 2KB
SHA256 974f124f51aed731520317f4208fa5d598cf7b53f4a01b16b486b9ea26cd1d1e
MD5 c17195d82e0ac5efc7447e1066011500
SHA1 3b70abc1e82509fb7634a8f83ff634e2a0cfdef4
SHA512 46913b98ddfe8dc115a4cb9c78f3f5a14ca9d0c0a1ecd8a25ce5a4568ad08ecc21c0e5cc662cc1453d04566e6a64e63c3cd2ed89accb1455e25a34452a56294b
TLSH
T12351BCA474869DB252FE24CE4C46815FEEEA4D726FFF9CA4221488C74C134F038CB968
MD5 SHA1 SHA512 TLSH

Submit Download

F6xcad_decoder_write.vbs

Path C:\Users\Admin\AppData\Local\Temp\F6xcad_decoder_write.vbs
Size 3KB
SHA256 04ddf0e678ca9918192f0b93e1eac0a7536c6648c815e1e557e3872f468fd874
MD5 d02ff6c38424f06cb576c59571e84ea6
SHA1 bba5d8441b4e9c73ab58f795bc35e381e6d89724
SHA512 b218a129cc64fb028a0c0c79616834b1195e0f802eebaa51be5e5965d001dbf28baf62c431302c7e3734ffd63ba3d934dc04379a87368862b1cdbde7ae17921a
TLSH
T11C81672325937ACCDFC1251FCEE80B028A55566A35A37BC5286AA4DEC0D459FD12C17F
MD5 SHA1 SHA512 TLSH

Submit Download

F6xcad_junk.vbs

Path C:\Users\Admin\AppData\Local\Temp\F6xcad_junk.vbs
Size 158B
SHA256 dc9f7aa6b562e269653892d917c266dac44b98e1b78c3c3cf41109fda776b3d9
MD5 49f360f133f2b55e4b38133a502ec733
SHA1 88eda5c8138d0e39eeb03e02c3b576fd1b759484
SHA512 8dea1801a4c00fe99ffc76847a8aef8113c4ad6c9b723ce2bf54836835514153c1248fbcc15dd5f304d822bcae7e1c82f52d31246363516464152415427f5bbd
TLSH
T121C08C68D41E5A880DF2A0A50271C1AC5840EC4300B0A72C530C730C35E17F4080E0DE
MD5 SHA1 SHA512 TLSH

Submit Download

F6xcad_mem1.vbs

Path C:\Users\Admin\AppData\Local\Temp\F6xcad_mem1.vbs
Size 868B
SHA256 a052aa194828c0ca38902084c0e2e93e1a8ab9b33cfba9b8075e11272467c01d
MD5 7550a5b10f4d40ba48fc8dd60725576f
SHA1 89a1faa82e16bf994e382c25c135179224b46035
SHA512 740a32ee0c1d3ced6fe79c8985b5736246ceeccee3a142a690b508c779891509e936382638f1de830637c8cb6a40453fd19b80c33ed3df8ccf3dea978f7e422a
TLSH
T1AC11A72D545BF8DF8595830282081969DE604F06B621F9F85DA6F8D990783604CD7FC7
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ha1n3swu.1ag.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ha1n3swu.1ag.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

winlogon.exe

Path C:\Users\Admin\AppData\Local\Temp\winlogon.exe
Size 78KB
SHA256 e5acc13fbefebd4c835cd4c33c5fc0d90e4c8e05b7150da97cbac819ab2a57f6
MD5 3449a7e7f309e588a3954832a2ea2880
SHA1 1a5d20fa6d8234fba4d29415a149dbc98b06519e
SHA512 63a0e2ec72b6c60616e089ee2b8f5f156702eb18ad6b579f485cdef13eda1618fe4c8da88be7782afe1627ccea3ebd12a8fcf529609101c51474e87f98958fe3
SSDEEP 1536:1apbn3vioDHwj/VTsqa4tsi5XKjv51wbFgCQ2bwrkoQ:1apbn3V2VAX4tnkjR1wbF7Q2MtQ
TLSH
T100734C1033FD5126E6AF8B3D99B451004F36BA636E72DA4D5C46908C0AB6B82DD60FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup_2MNXKHDYXEZIcDq3ev0EIsks5tsCBh.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_2MNXKHDYXEZIcDq3ev0EIsks5tsCBh.bat
Size 534B
SHA256 43f98116381527df52f6d430a78887c8d45f8a85918fdcb150c1ffe5b3585cb7
MD5 ea39888872d7a87b3b21322745bb3e4f
SHA1 31f2513a12f7f544fd9ce2167a6cdaba9e04aca5
SHA512 748af583b93167d185e1dd9628f3ac56c99686e7f0c1dd0ca5e1975d5b61c60b5a16664e309d669c4618cc69282a37ea648989dd6df46d3393e143e8665fd96d
TLSH
T175F0590A228E87495420607B0EF7318DC0B944577F987A05BB20C02A1BD241BF6C77E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/840-118-0x000002DEBD5B0000-0x000002DEBD5BC000-memory.dmp

Download

memory/1132-140-0x000001E0A1F60000-0x000001E0A2256000-memory.dmp

Download

memory/1132-152-0x000001E0879A0000-0x000001E0879AC000-memory.dmp

Download

memory/1268-126-0x000001DB88770000-0x000001DB8878A000-memory.dmp

Download

memory/1268-127-0x000001DB8A3F0000-0x000001DB8A3F8000-memory.dmp

Download

memory/1640-143-0x000002BFB27A0000-0x000002BFB27C2000-memory.dmp

Download

memory/1640-151-0x000002BF9A0B0000-0x000002BF9A0BC000-memory.dmp

Download

memory/3412-122-0x00000217012D0000-0x00000217012DC000-memory.dmp

Download

memory/4112-3-0x000001E2A9B80000-0x000001E2A9B8C000-memory.dmp

Download

memory/5104-6-0x000002570C190000-0x000002570C19C000-memory.dmp

Download

memory/5720-0-0x00000201F85F0000-0x00000201F8669000-memory.dmp

Download