5c494fdb91eea252c509c8443b76764379d5ec91689e770fd627238d23ec85c2

Analysis

max time kernel
149s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZipRipper.cmd
Size 55KB
Sample260415-emn2eshw8x
SHA256 5c494fdb91eea252c509c8443b76764379d5ec91689e770fd627238d23ec85c2
MD5 5d2fc050bb45075f6e0c244114590cda
SHA1 0804297bb25e35d011084ad3f60effd01e9e786f
SHA512 2dfba72f4a656482d93c77b02472e7b305b674fa0f270e8c1dc2297d6758987aae5343bf3f84598e697be095a9b7bb7a230f03cdde9e6131b4389aaddca797f7
SSDEEP 1536:ShJ6WUpefX3zTwisL9zdRTtfHwedIM7hews0/+AcVpa:PpefX3zTwisL9zdRTtPfdIjws0/+AcVg
TLSH
T19B431938FB495D9C436247B2953B0D54D51FECAB204DAD94BDACCD0EEE882484276AF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3760	powershell.exe
9	3760	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5576	powershell.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
3992	tasklist.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3992	tasklist.exe
3992	tasklist.exe
3760	powershell.exe
3760	powershell.exe
5576	powershell.exe
5576	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3992	tasklist.exe
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeDebugPrivilege	5576	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 3992	4748	cmd.exe	85
PID 4748 wrote to memory of 4040	4748	cmd.exe	86
PID 4748 wrote to memory of 5084	4748	cmd.exe	88
PID 5084 wrote to memory of 3760	5084	cmd.exe	89
PID 4748 wrote to memory of 5576	4748	cmd.exe	91
PID 5576 wrote to memory of 2144	5576	powershell.exe	92
PID 2144 wrote to memory of 2520	2144	csc.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ZipRipper.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\system32\tasklist.exe
  TASKLIST /V /NH /FI "imagename eq cmd.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3992
- C:\Windows\system32\findstr.exe
  FINDSTR /I /C:"ZIP-Ripper"
  2⤵
  PID:4040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c POWERSHELL -nop -c "$ProgressPreference='SilentlyContinue';irm http://www.msftncsi.com/ncsi.txt;$ProgressPreference='Continue'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    POWERSHELL -nop -c "$ProgressPreference='SilentlyContinue';irm http://www.msftncsi.com/ncsi.txt;$ProgressPreference='Continue'"
    3⤵
    - Badlisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  POWERSHELL -nop -c "$w=Add-Type -Name WAPI -PassThru -MemberDefinition '[DllImport("""user32.dll""")]public static extern void SetProcessDPIAware();[DllImport("""shcore.dll""")]public static extern void SetProcessDpiAwareness(int value);[DllImport("""kernel32.dll""")]public static extern IntPtr GetConsoleWindow();[DllImport("""user32.dll""")]public static extern void GetWindowRect(IntPtr hwnd,int[] rect);[DllImport("""user32.dll""")]public static extern void GetClientRect(IntPtr hwnd, int[] rect);[DllImport("""user32.dll""")]public static extern void GetMonitorInfoW(IntPtr hMonitor, int[] lpmi);[DllImport("""user32.dll""")]public static extern IntPtr MonitorFromWindow(IntPtr hwnd, int dwFlags);[DllImport("""user32.dll""")]public static extern int SetWindowPos(IntPtr hwnd,IntPtr hwndAfterZ,int x,int y,int w,int h,int flags);';$PROCESS_PER_MONITOR_DPI_AWARE=2;try{$w::SetProcessDpiAwareness($PROCESS_PER_MONITOR_DPI_AWARE)}catch{$w::SetProcessDPIAware()}$hwnd=$w::GetConsoleWindow();$moninf=[int[]]::new(10);$moninf[0]=40;$MONITOR_DEFAULTTONEAREST=2;$w::GetMonitorInfoW($w::MonitorFromWindow($hwnd, $MONITOR_DEFAULTTONEAREST), $moninf);$monwidth=$moninf[7]-$moninf[5];$monheight=$moninf[8]-$moninf[6];$wrect=[int[]]::new(4);$w::GetWindowRect($hwnd, $wrect);$winwidth=$wrect[2]-$wrect[0];$winheight=$wrect[3]-$wrect[1];$x=[int][math]::Round($moninf[5]+$monwidth/2-$winwidth/2);$y=[int][math]::Round($moninf[6]+$monheight/2-$winheight/2);$SWP_NOSIZE=0x0001;$SWP_NOZORDER=0x0004;exit [int]($w::SetWindowPos($hwnd,[IntPtr]::Zero,$x,$y,0,0,$SWP_NOSIZE -bOr $SWP_NOZORDER) -eq 0)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5576
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0x3k0byy\0x3k0byy.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCFDE.tmp" "c:\Users\Admin\AppData\Local\Temp\0x3k0byy\CSC85E79A3055B54F1DA2819C47311023.TMP"
      4⤵
      PID:2520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 43b2c2ccaf9232dc2adba8afb100b341f70c2136b705b181b01886fc7b38bf05
MD5 5ca8de8aad89d954731f7fc042cf00a6
SHA1 e585b6cb9678ba8b359eaad4785af976b9898fc8
SHA512 527f11a50ffe558ab5777b387a2327b307bfb066044e0b9bba5c80600c24b74eec0a57dd3cd2be0f061e3bf240e9ba7d48af1a9035daad6baf4e43e799f80d3b
TLSH
T1FA11B623F38CC920CC86113A409EAC1136B683CB41AECF9FAFC0D214A07F984CB71290
MD5 SHA1 SHA512 TLSH

Submit Download

0x3k0byy.dll

Path C:\Users\Admin\AppData\Local\Temp\0x3k0byy\0x3k0byy.dll
Size 3KB
SHA256 15f402c40813ec5f118bcfc4b33e11ba6062a2f68ece5f3ef1d7cca5576e40a8
MD5 f6bdbbbd9c29e60572d4ca58fbb3c046
SHA1 acf87575d6931da89454192e3630f2554d9b103f
SHA512 3441cb370d3205bf497891099e141e5624caf3bf115e8756d665a763a8000e209fe41c4a0697c44ad1dbd5b6df7d78d8d95444c088b56b5f14dfa7db3229e4db
TLSH
T18B71F117A3E84567E4B20739ADF3831A33B4F8889B63575B19A4422DBCA22741935FE1
MD5 SHA1 SHA512 TLSH

Submit Download

RESCFDE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESCFDE.tmp
Size 1KB
SHA256 e54912be21d633301e93ea91e4fe5d3861913e541bfee9c5aed46681fb62c2cf
MD5 a1e3a91dc09c076f6ae02050fd0fd837
SHA1 08de307ffaed638b2865a563124b79a24eccf841
SHA512 fa97f1f01ca5b7e669adea244de6ff885f03560e4a94cfc1e7b26263b9b2d971698622f2fac4b8e8c9bd324f56c591590c2a699fa732d886fe77d2d0ef21d53c
TLSH
T13021890183ED4B0EF07747316AF6572BA624FDA4AFA2675B858052282C61544EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1oiw5lhv.qjc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1oiw5lhv.qjc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

0x3k0byy.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\0x3k0byy\0x3k0byy.0.cs
Size 899B
SHA256 0aed36513811d5a2a36ec7e4aa2fc98ff931cf27d6f7e5394515b8aafae9b252
MD5 2243cf02366045a3304a61b0d91b4aaa
SHA1 9f2b912895e713abb703dd183c85e78336bcb37d
SHA512 8ae2c8d8bef884fafa220d4c3bc75417a5aae3b5f2f6b928963c4c78d5aedb0abfd0a4ec2ffd4201cf30c9615d1ca31cbee7e57545a3123632d9f4a95c056db5
TLSH
T171115C20A722EF342442C41DCC94997EF31B707173BE1B06557DAB128F5B04A16BA7A6
MD5 SHA1 SHA512 TLSH

Submit Download

0x3k0byy.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\0x3k0byy\0x3k0byy.cmdline
Size 369B
SHA256 5474fc830cac22cc424ae2bc87a84982073ec44cc3db6b0d04ff1b6cfefc3e53
MD5 91bb563b14038207058366e09f255c74
SHA1 e27b28d536c85aebf9f135c6090396025ed7cf2f
SHA512 8ee158394cbb8207d6044c52bdedd5c7b631fcb5a96753f15f88d92d308f8a75f2e3bcb74dfe842c890220ef75508b84b95b743c2ba694e695e75686750d8d8e
TLSH
T1A5E0C62A8266C27D41EE100F367AC8ACCB720B8329803F84D040842DE0370033BD2B81
MD5 SHA1 SHA512 TLSH

Submit Download

CSC85E79A3055B54F1DA2819C47311023.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\0x3k0byy\CSC85E79A3055B54F1DA2819C47311023.TMP
Size 652B
SHA256 84ed12f13fea49f59fb6cd3b3330f312ac67b365ac2df8df523525360f1a8388
MD5 5cdc21e908d12017ecb34bd4874b3c3a
SHA1 fbccaa6994fee754593bb901b9d26026d1616ce0
SHA512 af991d7fefc4f8723a869237d29d3bbe3e30f3e75caa57d293bab8091d8b8c045278658c84c2311800424754fd62e4767f6fe6484048cb27ef72adc392d0896d
TLSH
T1C4F0820A63F8030EF4F34B30BDF643A395A8BC65DE3293ED1480036D6C646108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2144-41-0x0000026138380000-0x000002613838C000-memory.dmp

Download

memory/2520-38-0x0000027FA5230000-0x0000027FA523C000-memory.dmp

Download

memory/3760-19-0x00000181DB290000-0x00000181DB29C000-memory.dmp

Download

memory/3760-2-0x00000181DB810000-0x00000181DB820000-memory.dmp

Download

memory/3760-16-0x00000181DB810000-0x00000181DB820000-memory.dmp

Download

memory/3760-12-0x00000181DB810000-0x00000181DB820000-memory.dmp

Download

memory/3760-11-0x00000181DB290000-0x00000181DB29C000-memory.dmp

Download

memory/3760-8-0x00000181DB7D0000-0x00000181DB7F2000-memory.dmp

Download

memory/3760-1-0x00000181DB810000-0x00000181DB820000-memory.dmp

Download

memory/3992-0-0x000001F49F4E0000-0x000001F49F835000-memory.dmp

Download

memory/5576-43-0x000001B0D2C40000-0x000001B0D2C48000-memory.dmp

Download

memory/5576-45-0x000001B0B8A60000-0x000001B0B8A6C000-memory.dmp

Download