4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/02/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
service2.bat
Size 210KB
Sample260223-tktw8aay3d
SHA256 4da90557bd724fee747a693df7fe07c2c6c6f7ed9a07a252ff498942d33c6343
MD5 ff794a3dcdf6e8c3747c1477551d2509
SHA1 149b54f7f975df668cc22fecf2c14a05f2fe5023
SHA512 dd3cac80df20f1872af52bfa1bb96971eda206b26dcd10e46fef1446ff3eeefb2d9b68ae0b6803f668b019ac433ff30e469db2007fe19ac3b34ce1f7e45dd21c
SSDEEP 6144:GHxMpQ4vfYZueRvh3vuu1YPcFh0AQX0ymPFh:WvWfYEeVh/ukdFhToaf
TLSH
T100240223DC842D6EB76015AB6C092F8222C13574176F7DCF83E1AAE450D7F62770A6B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5440	powershell.exe
5440	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2448	winlogon.exe
5484	winlogon.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Windows\CurrentVersion\Run\	winlogon.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
1264	timeout.exe
5464	timeout.exe
792	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2740	schtasks.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
5484	winlogon.exe
5440	powershell.exe
5440	powershell.exe
5440	powershell.exe
5440	powershell.exe
5440	powershell.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe
5484	winlogon.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4112	WMIC.exe
Token: SeSecurityPrivilege	4112	WMIC.exe
Token: SeTakeOwnershipPrivilege	4112	WMIC.exe
Token: SeLoadDriverPrivilege	4112	WMIC.exe
Token: SeSystemProfilePrivilege	4112	WMIC.exe
Token: SeSystemtimePrivilege	4112	WMIC.exe
Token: SeProfSingleProcessPrivilege	4112	WMIC.exe
Token: SeIncBasePriorityPrivilege	4112	WMIC.exe
Token: SeCreatePagefilePrivilege	4112	WMIC.exe
Token: SeBackupPrivilege	4112	WMIC.exe
Token: SeRestorePrivilege	4112	WMIC.exe
Token: SeShutdownPrivilege	4112	WMIC.exe
Token: SeDebugPrivilege	4112	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4112	WMIC.exe
Token: SeRemoteShutdownPrivilege	4112	WMIC.exe
Token: SeUndockPrivilege	4112	WMIC.exe
Token: SeManageVolumePrivilege	4112	WMIC.exe
Token: 33	4112	WMIC.exe
Token: 34	4112	WMIC.exe
Token: 35	4112	WMIC.exe
Token: 36	4112	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4112	WMIC.exe
Token: SeSecurityPrivilege	4112	WMIC.exe
Token: SeTakeOwnershipPrivilege	4112	WMIC.exe
Token: SeLoadDriverPrivilege	4112	WMIC.exe
Token: SeSystemProfilePrivilege	4112	WMIC.exe
Token: SeSystemtimePrivilege	4112	WMIC.exe
Token: SeProfSingleProcessPrivilege	4112	WMIC.exe
Token: SeIncBasePriorityPrivilege	4112	WMIC.exe
Token: SeCreatePagefilePrivilege	4112	WMIC.exe
Token: SeBackupPrivilege	4112	WMIC.exe
Token: SeRestorePrivilege	4112	WMIC.exe
Token: SeShutdownPrivilege	4112	WMIC.exe
Token: SeDebugPrivilege	4112	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4112	WMIC.exe
Token: SeRemoteShutdownPrivilege	4112	WMIC.exe
Token: SeUndockPrivilege	4112	WMIC.exe
Token: SeManageVolumePrivilege	4112	WMIC.exe
Token: 33	4112	WMIC.exe
Token: 34	4112	WMIC.exe
Token: 35	4112	WMIC.exe
Token: 36	4112	WMIC.exe
Token: SeDebugPrivilege	5484	winlogon.exe
Token: SeDebugPrivilege	5484	winlogon.exe
Token: SeDebugPrivilege	5440	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 4112	3476	cmd.exe	80
PID 3476 wrote to memory of 3876	3476	cmd.exe	81
PID 3476 wrote to memory of 5592	3476	cmd.exe	83
PID 3476 wrote to memory of 2884	3476	cmd.exe	84
PID 3476 wrote to memory of 8	3476	cmd.exe	85
PID 3476 wrote to memory of 1716	3476	cmd.exe	86
PID 3476 wrote to memory of 1300	3476	cmd.exe	87
PID 3476 wrote to memory of 2448	3476	cmd.exe	88
PID 3476 wrote to memory of 792	3476	cmd.exe	89
PID 2448 wrote to memory of 5468	2448	winlogon.exe	90
PID 5468 wrote to memory of 5672	5468	cmd.exe	92
PID 5468 wrote to memory of 1264	5468	cmd.exe	93
PID 5468 wrote to memory of 5484	5468	cmd.exe	94
PID 5468 wrote to memory of 5464	5468	cmd.exe	95
PID 5484 wrote to memory of 2740	5484	winlogon.exe	96
PID 5484 wrote to memory of 5992	5484	winlogon.exe	99
PID 5992 wrote to memory of 5440	5992	cmd.exe	101

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\service2.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\System32\Wbem\WMIC.exe
  wmic computersystem get manufacturer,model
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4112
- C:\Windows\system32\findstr.exe
  findstr /i "vmware virtualbox qemu xen parallels"
  2⤵
  PID:3876
- C:\Windows\system32\mode.com
  mode con cols=10 lines=1
  2⤵
  PID:5592
- C:\Windows\system32\cscript.exe
  cscript //nologo //e:vbscript "F6xcad_junk.vbs"
  2⤵
  PID:2884
- C:\Windows\system32\cscript.exe
  cscript //nologo //e:vbscript "F6xcad_mem1.vbs"
  2⤵
  PID:8
- C:\Windows\system32\cscript.exe
  cscript //nologo //e:vbscript "F6xcad_decoder_write.vbs"
  2⤵
  PID:1716
- C:\Windows\system32\cscript.exe
  cscript //nologo //e:vbscript "F6xcad.vbs"
  2⤵
  PID:1300
- C:\Users\Admin\AppData\Local\Temp\winlogon.exe
  "winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_KEAyXpWuhQHaOy2VsiuRDx2l46OcMU.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5468
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5672
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1264
  - - C:\Users\Admin\AppData\Roaming\PlatformRuntime\winlogon.exe
      "C:\Users\Admin\AppData\Roaming\PlatformRuntime\winlogon.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5484
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "" /sc ONLOGON /tr "" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2740
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell.exe -NonI -W Hidden -Exec Bypass "Add-MpPreference -ExclusionProcess (Get-Process -Id $PID).Path"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5992
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NonI -W Hidden -Exec Bypass "Add-MpPreference -ExclusionProcess (Get-Process -Id $PID).Path"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5440
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5464
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winlogon.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log
Size 859B
SHA256 a6f7d3892a001df1aafe2eaf221a3b09a4fdad23ad642a62b9cc50fd25f9415f
MD5 b80ab36515c0740685e38a5cd01e292a
SHA1 ebea40ce14021888f2c869576ad62b98b7c73c8a
SHA512 a9ad31c000c2264f8a9b7bac6bc60edd7ecf0d1c946a4bb3e57d824283c6b65e59344e834bcbf563586211078ddb895af13e4c697bea2c4a907982bbc5fbd4a0
TLSH
T1CE1166313376A0D889163F821C1E56C957BF4329A550AD08B998624DED3601B6B213E3
MD5 SHA1 SHA512 TLSH

Submit Download

F6xcad.tmp

Path C:\Users\Admin\AppData\Local\Temp\F6xcad.tmp
Size 104KB
SHA256 6587304399200f1104087b706ce890bbaa50e680b418f88d603fc0ce355ac586
MD5 d0cab9d8581341441ce865b4ebadb384
SHA1 d96cf25ec439f9cf331c715ac180928ff6e4a502
SHA512 b60ebcc6082dec4868b4b03f48fbf8b2546f9df60a60d0524d5bf247f6793f7c4fe6dff6982ababe8990826eb4e2814bf8b752d4e30f9e953dab66982e0218e9
SSDEEP 1536:WfYoGFdol8WWA1CM3F/zYQ0hpFywroSnCJQpOnrIAynIZbnFcoBaRyPGnFT6:QmCWk4mr0Iwro4CBrhynwFcooRLFO
TLSH
T169A30223ECD8BE3E8C24AF6BCD037E4954862C911B6EB5C7C141C8D913D2E65D54F626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F6xcad.tmp

Path C:\Users\Admin\AppData\Local\Temp\F6xcad.tmp
Size 26KB
SHA256 9dce66b55dd48a97102a2587639dc29959c45d124c26dd94457cf3c6f72f4c9a
MD5 5605bc314b5f97be336e8f582732ea25
SHA1 4ef24002694483785626286fdf6047e20ba0381d
SHA512 98dd356da54ed7e63536ad505d39b5a2d5ee1bbd2122890f6c17b504827a49e95e14690522dd42b68634f11f8b4e7ab29357fde049bc225400c13106d8045589
SSDEEP 768:Wfl8fl8AFtQDGFdol0zbD6pcnRA1CWNx/3jZq:WfYoGFdol8WWA1CM3Fq
TLSH
T150C2D02B87644B3CC134AF678F017FE9A89E3A913DAF6197C2C14DF01AD18A42B452D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F6xcad.vbs

Path C:\Users\Admin\AppData\Local\Temp\F6xcad.vbs
Size 2KB
SHA256 974f124f51aed731520317f4208fa5d598cf7b53f4a01b16b486b9ea26cd1d1e
MD5 c17195d82e0ac5efc7447e1066011500
SHA1 3b70abc1e82509fb7634a8f83ff634e2a0cfdef4
SHA512 46913b98ddfe8dc115a4cb9c78f3f5a14ca9d0c0a1ecd8a25ce5a4568ad08ecc21c0e5cc662cc1453d04566e6a64e63c3cd2ed89accb1455e25a34452a56294b
TLSH
T12351BCA474869DB252FE24CE4C46815FEEEA4D726FFF9CA4221488C74C134F038CB968
MD5 SHA1 SHA512 TLSH

Submit Download

F6xcad_decoder_write.vbs

Path C:\Users\Admin\AppData\Local\Temp\F6xcad_decoder_write.vbs
Size 3KB
SHA256 04ddf0e678ca9918192f0b93e1eac0a7536c6648c815e1e557e3872f468fd874
MD5 d02ff6c38424f06cb576c59571e84ea6
SHA1 bba5d8441b4e9c73ab58f795bc35e381e6d89724
SHA512 b218a129cc64fb028a0c0c79616834b1195e0f802eebaa51be5e5965d001dbf28baf62c431302c7e3734ffd63ba3d934dc04379a87368862b1cdbde7ae17921a
TLSH
T11C81672325937ACCDFC1251FCEE80B028A55566A35A37BC5286AA4DEC0D459FD12C17F
MD5 SHA1 SHA512 TLSH

Submit Download

F6xcad_junk.vbs

Path C:\Users\Admin\AppData\Local\Temp\F6xcad_junk.vbs
Size 158B
SHA256 dc9f7aa6b562e269653892d917c266dac44b98e1b78c3c3cf41109fda776b3d9
MD5 49f360f133f2b55e4b38133a502ec733
SHA1 88eda5c8138d0e39eeb03e02c3b576fd1b759484
SHA512 8dea1801a4c00fe99ffc76847a8aef8113c4ad6c9b723ce2bf54836835514153c1248fbcc15dd5f304d822bcae7e1c82f52d31246363516464152415427f5bbd
TLSH
T121C08C68D41E5A880DF2A0A50271C1AC5840EC4300B0A72C530C730C35E17F4080E0DE
MD5 SHA1 SHA512 TLSH

Submit Download

F6xcad_mem1.vbs

Path C:\Users\Admin\AppData\Local\Temp\F6xcad_mem1.vbs
Size 868B
SHA256 a052aa194828c0ca38902084c0e2e93e1a8ab9b33cfba9b8075e11272467c01d
MD5 7550a5b10f4d40ba48fc8dd60725576f
SHA1 89a1faa82e16bf994e382c25c135179224b46035
SHA512 740a32ee0c1d3ced6fe79c8985b5736246ceeccee3a142a690b508c779891509e936382638f1de830637c8cb6a40453fd19b80c33ed3df8ccf3dea978f7e422a
TLSH
T1AC11A72D545BF8DF8595830282081969DE604F06B621F9F85DA6F8D990783604CD7FC7
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_yty5yv2o.ooi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yty5yv2o.ooi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

winlogon.exe

Path C:\Users\Admin\AppData\Local\Temp\winlogon.exe
Size 78KB
SHA256 e5acc13fbefebd4c835cd4c33c5fc0d90e4c8e05b7150da97cbac819ab2a57f6
MD5 3449a7e7f309e588a3954832a2ea2880
SHA1 1a5d20fa6d8234fba4d29415a149dbc98b06519e
SHA512 63a0e2ec72b6c60616e089ee2b8f5f156702eb18ad6b579f485cdef13eda1618fe4c8da88be7782afe1627ccea3ebd12a8fcf529609101c51474e87f98958fe3
SSDEEP 1536:1apbn3vioDHwj/VTsqa4tsi5XKjv51wbFgCQ2bwrkoQ:1apbn3V2VAX4tnkjR1wbF7Q2MtQ
TLSH
T100734C1033FD5126E6AF8B3D99B451004F36BA636E72DA4D5C46908C0AB6B82DD60FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup_KEAyXpWuhQHaOy2VsiuRDx2l46OcMU.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_KEAyXpWuhQHaOy2VsiuRDx2l46OcMU.bat
Size 534B
SHA256 06df93a9c0983b00c2b4bcd380a11349f403eb4349bde3f2221055a225c47e3a
MD5 c4ae5d76cf86090870b7cce9a7ea3bce
SHA1 3e3486bdd32e28d9734ec0931b8114906f7c1e32
SHA512 977439fcb024fa9aa5a095cfc749e91bdbd6201731f7ed019eb62e98801a99d256afe3646948a926b481a2c21d125f1192226d9e0f227505dec0138045e80c16
TLSH
T1A2F0590A228E834D5420607B0EF732CDC0F544573FA97A427B38C02A5BD240BEAC77E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/8-5-0x0000023981C80000-0x0000023981D2F000-memory.dmp

Download

memory/1300-121-0x00000276CD5D0000-0x00000276CD67F000-memory.dmp

Download

memory/1716-117-0x0000022478F30000-0x0000022478FDF000-memory.dmp

Download

memory/2448-125-0x000001CA825D0000-0x000001CA825EA000-memory.dmp

Download

memory/2448-126-0x000001CA9CBF0000-0x000001CA9CBF8000-memory.dmp

Download

memory/2884-2-0x000002285A070000-0x000002285A11F000-memory.dmp

Download

memory/5440-155-0x0000025DCE020000-0x0000025DCE02A000-memory.dmp

Download

memory/5440-160-0x0000025DCE5B0000-0x0000025DCE5B6000-memory.dmp

Download

memory/5440-153-0x0000025DCE030000-0x0000025DCE04C000-memory.dmp

Download

memory/5440-154-0x0000025DCE260000-0x0000025DCE313000-memory.dmp

Download

memory/5440-164-0x0000025DB5CE0000-0x0000025DB5D8F000-memory.dmp

Download

memory/5440-156-0x0000025DCE590000-0x0000025DCE5AC000-memory.dmp

Download

memory/5440-157-0x0000025DCE570000-0x0000025DCE57A000-memory.dmp

Download

memory/5440-158-0x0000025DCE5D0000-0x0000025DCE5EA000-memory.dmp

Download

memory/5440-159-0x0000025DCE580000-0x0000025DCE588000-memory.dmp

Download

memory/5440-145-0x0000025DB5DE0000-0x0000025DB5E02000-memory.dmp

Download

memory/5440-161-0x0000025DCE5C0000-0x0000025DCE5CA000-memory.dmp

Download

memory/5440-165-0x0000025DB5950000-0x0000025DB5962000-memory.dmp

Download

memory/5484-139-0x000001A264750000-0x000001A264A46000-memory.dmp

Download

memory/5484-168-0x000001A264B90000-0x000001A264B9A000-memory.dmp

Download

memory/5484-167-0x000001A264120000-0x000001A264132000-memory.dmp

Download

memory/5484-166-0x000001A264010000-0x000001A2640BF000-memory.dmp

Download

memory/5484-169-0x000001A264BA0000-0x000001A264BB0000-memory.dmp

Download

memory/5484-209-0x000001A264BA0000-0x000001A264BB0000-memory.dmp

Download