37af4c4519fe8fe3331d56e74ff2be57c09a46041b32c5a3233acc243b456945

Resubmissions

16/04/2026, 02:01

260416-cfqwbsht9s8

16/04/2026, 01:57

260416-cdc7fsd12j6

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/04/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TraceX Final/Run-TraceX-HWID-Spoofer.bat
Size 6KB
Sample260416-cdc7fsd12j
SHA256 37af4c4519fe8fe3331d56e74ff2be57c09a46041b32c5a3233acc243b456945
MD5 4f98523504c362ef51a4c82768e8b51a
SHA1 8d3c001925d58761b5707f8a10d662d7b77416c6
SHA512 95baf291c47eb91da07ba20025df0c93b54e9b06bc1afd5f2090a991ade6b50a88083472543377d1b8f6c55b50c9e0d8ec231735114291b02b5997f2972dbbfb
SSDEEP 192:H55Iq2WQKBJ+mglJIqL1WRDK6DFD66DFOQDF:Z/QNPGe6pW65OQZ
TLSH
T1A3D12122342E97760ABED52884250069F55A62CF61085EFDF1AFD1781F38384DBFE5C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3664	powershell.exe
4568	powershell.exe
4132	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3664	powershell.exe
3664	powershell.exe
4568	powershell.exe
4568	powershell.exe
4132	powershell.exe
4132	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeDebugPrivilege	4132	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 4420	4232	cmd.exe	85
PID 4232 wrote to memory of 4240	4232	cmd.exe	86
PID 4240 wrote to memory of 3664	4240	cmd.exe	87
PID 4232 wrote to memory of 4568	4232	cmd.exe	88
PID 4232 wrote to memory of 4132	4232	cmd.exe	89
PID 4232 wrote to memory of 2856	4232	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TraceX Final\Run-TraceX-HWID-Spoofer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:4420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Get-ExecutionPolicy -Scope CurrentUser" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-ExecutionPolicy -Scope CurrentUser"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$blocked = Get-ChildItem -Path 'C:\Users\Admin\AppData\Local\Temp\TraceX Final\' -Recurse | Where-Object { $_.IsBlocked }; if ($blocked) { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Write-Host 'Test' | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4132
- C:\Windows\system32\choice.exe
  choice /C YN /M "Would you like to configure PowerShell now"
  2⤵
  PID:2856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 4a9eaf531e98772ed6787d094772574eb724f4ef0a33f02ff146589ebcb1b4e0
MD5 d056c6d78b10c5cd439cdc2324ec98a1
SHA1 f8d220f91337d612aabdb2e347f2c6b7781505de
SHA512 20c9b88fc567b0a7e5790c0a2200d286dbebf8331c81a1f11614d4b928500b53df6429d3dc00b38391b06c13946333605ee8d5ee57dee64247fde040fc14b923
TLSH
T1DB51EE323375B1E888167F071E68598053BF4355FA94AF0CB698621EDE2741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 787628c3dd129679416857bcb63c52f8477a02cfeadfe0d4d5d98eb7902c61d8
MD5 40588a42cb8549ecc094e7d45f28c74c
SHA1 65d5d1f79fe82009c3c4c6d2c7ce874939926b8b
SHA512 e77dd348027e9df604520e228061f2e9c3d87ad695567c81dd95976eaba7df580eb565bff8b485558a0561bdd0de6ac202ead1965f6c23f746e5542ff9bea3c6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 daa246f73567ad176e744abdb82d991dd8cffe0e2d847d2feefeb84f7fa5f882
MD5 2238871af228384f4b8cdc65117ba9f1
SHA1 2a200725f1f32e5a12546aa7fd7a8c5906757bd1
SHA512 1833d508fdbe2b8722b787bfc0c1848a5bcdeb7ec01e94158d78e9e6ceb397a2515d88bb8ca4ec1a810263fc900b5b1ea1d788aa103967ed61436e617fab47bf
TLSH
T15F115323B39C89A1CC96163A509D9C1172B682C7819EDFDF6BC0C205A1BF598CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lv303vcw.lyr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lv303vcw.lyr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3664-0-0x00000204F7BB0000-0x00000204F7BC0000-memory.dmp

Download

memory/3664-8-0x00000204F7B10000-0x00000204F7B32000-memory.dmp

Download

memory/3664-12-0x00000204DDC10000-0x00000204DDC1C000-memory.dmp

Download

memory/3664-11-0x00000204DD970000-0x00000204DDB11000-memory.dmp

Download

memory/4132-34-0x000001AC46350000-0x000001AC4635C000-memory.dmp

Download

memory/4568-14-0x000002B2E5310000-0x000002B2E5320000-memory.dmp

Download

memory/4568-24-0x000002B2CCBD0000-0x000002B2CCBDC000-memory.dmp

Download