5c883568110c2ae4a4d4be437bad08d5b09c9dfabd81e5f3199ae2fac51aba4c

Analysis

max time kernel
149s
max time network
100s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Pacܵ绰г/lib/driverfile/spc/import.bat
Size 55B
Sample260506-gzmegaft6j
SHA256 5c883568110c2ae4a4d4be437bad08d5b09c9dfabd81e5f3199ae2fac51aba4c
MD5 236b3c8474160ef901623ffc48909057
SHA1 72157dd376afa135b585a70758ad2251073b2790
SHA512 5302d915c53cebc0f18efd1cb8082e64ef3653d14316d422b05ff2d5b78fea664ac7fd733a777e403cddcc602f64c5fa68f6b908a0565a88f924f88eceeb135a
TLSH
T1E8900200A53E6151830201609E54D34D2196A42B1505DF7149544C94365529121518AE
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion spyware trojan

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5484	rundll32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225218367187900"	rundll32.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\REQUEST	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\CA\Certificates\59F6CAEFF9B4A872C6953044FD9768CF7BEA5E08	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\SystemCertificates\CA\Certificates\59F6CAEFF9B4A872C6953044FD9768CF7BEA5E08\Blob = 040000000100000010000000976bb5a7e6bd0653bd2be6a84d2c55da0f00000001000000100000008ac4012f991da0f4513aa964207f8ac4140000000100000014000000b89af5558dca524c244057bbe7e5f19649da0bfe190000000100000010000000abf06fd4ae019b95104a90a739a05af503000000010000001400000059f6caeff9b4a872c6953044fd9768cf7bea5e085c00000001000000040000000004000020000000010000008402000030820280308201e9a0030201020210dd824c0d0ccb9c9142d04291a9d5b79c300d06092a864886f70d010104050030423120301e06092a864886f70d01090116113934323137363640676d61696c2e636f6d311e301c060355040313154943433330312043616c6c2043656e746572204341301e170d3131313132333035303934325a170d3339313233313233353935395a30423120301e06092a864886f70d01090116113934323137363640676d61696c2e636f6d311e301c060355040313154943433330312043616c6c2043656e74657220434130819f300d06092a864886f70d010101050003818d0030818902818100d2ed7366d2912480c4c4e90fab9ba4b733a4991b48fbf9a29321b1cc702bd1e7cd65f2b343c218e77c2ed9d06492e92fa26a489ccf5e6449c1474330e260b6a48866469f7c6422f7a614e098b14a15a038cfe9f49f4bbb5b619c5953d8e4528f30c6228c8101aa8857b2fcbac91266b225f04516df3fe1fed957c9872cb939390203010001a377307530730603551d01046c306a8010a835145bd4f6fd6d4dc5f9bacc58a97fa14430423120301e06092a864886f70d01090116113934323137363640676d61696c2e636f6d311e301c060355040313154943433330312043616c6c2043656e7465722043418210dd824c0d0ccb9c9142d04291a9d5b79c300d06092a864886f70d0101040500038181004edc738ab1563f541d61339cc82dc01da6da5fad6992d899729459b00004bab2ffaba41a022e35432a6eff8344b3c0b5e83e899914e1a13eb319df791654c70072ca6d56ccb38d2d6e3813bf1749ecf347c7f2844a1a83d9197f518e14babc154d6f066c4d343cde187b98dc6149b1c412c966e5dbeaf42e5b01bbfeb19d3777	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 5484	5060	cmd.exe	79

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Pacܵ绰г\lib\driverfile\spc\import.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\system32\rundll32.exe
  rundll32.exe cryptext.dll,CryptExtAddCER icc301root.cer
  2⤵
  - Badlisted process makes network request
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  PID:5484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5484-4-0x000001E8CA9C0000-0x000001E8CA9CC000-memory.dmp

Download