7f3e8d35304fd0a307ebfc0a08960b923ef208a8466b70ff817aa391703075ab

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Զȵ/ڿӻ.cmd
Size 194B
Sample260601-phbkmsdv5l
SHA256 7f3e8d35304fd0a307ebfc0a08960b923ef208a8466b70ff817aa391703075ab
MD5 1aff48127f730f5471c23349c8057653
SHA1 893ebb037f47dbeb7863c2fd9e2313e2d5069819
SHA512 c985d955501ad5d6bda90d1c62381a514d3af6155f80edf3f74b3ed17f34ab1c5edde46e0363e968a2a120ae72458f694f594a27f24b8cfacd1e601e0a531d62
TLSH
T13FC02290821A49ACA2BB246E1121851BAE476003B198931232C908AC2A2C381C33A0C8
MD5 SHA1 SHA512 TLSH

Score

6^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3608	powershell.exe
4004	powershell.exe
2868	powershell.exe
2228	powershell.exe
3272	powershell.exe
2560	powershell.exe
4432	powershell.exe
4092	powershell.exe
4800	powershell.exe
4656	powershell.exe
6076	powershell.exe
3144	powershell.exe
5456	powershell.exe
4668	powershell.exe
4808	powershell.exe

Delays execution with timeout.exe 15 IoCs

defense_evasion

pid	Process
3092	timeout.exe
4880	timeout.exe
5252	timeout.exe
3576	timeout.exe
5148	timeout.exe
3568	timeout.exe
3700	timeout.exe
5280	timeout.exe
2260	timeout.exe
1484	timeout.exe
3988	timeout.exe
768	timeout.exe
4436	timeout.exe
5152	timeout.exe
356	timeout.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4656	powershell.exe
4656	powershell.exe
3272	powershell.exe
3272	powershell.exe
6076	powershell.exe
6076	powershell.exe
4004	powershell.exe
4004	powershell.exe
4668	powershell.exe
4668	powershell.exe
2868	powershell.exe
2868	powershell.exe
2560	powershell.exe
2560	powershell.exe
3144	powershell.exe
3144	powershell.exe
4432	powershell.exe
4432	powershell.exe
4808	powershell.exe
4808	powershell.exe
5456	powershell.exe
5456	powershell.exe
4092	powershell.exe
4092	powershell.exe
3608	powershell.exe
3608	powershell.exe
2228	powershell.exe
2228	powershell.exe
4800	powershell.exe
4800	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	3272	powershell.exe
Token: SeDebugPrivilege	6076	powershell.exe
Token: SeDebugPrivilege	4004	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeDebugPrivilege	5456	powershell.exe
Token: SeDebugPrivilege	4092	powershell.exe
Token: SeDebugPrivilege	3608	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	4800	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 4656	8	cmd.exe	80
PID 8 wrote to memory of 768	8	cmd.exe	81
PID 8 wrote to memory of 3272	8	cmd.exe	82
PID 8 wrote to memory of 3568	8	cmd.exe	83
PID 8 wrote to memory of 6076	8	cmd.exe	84
PID 8 wrote to memory of 3700	8	cmd.exe	85
PID 8 wrote to memory of 4004	8	cmd.exe	86
PID 8 wrote to memory of 5280	8	cmd.exe	87
PID 8 wrote to memory of 4668	8	cmd.exe	88
PID 8 wrote to memory of 4436	8	cmd.exe	89
PID 8 wrote to memory of 2868	8	cmd.exe	90
PID 8 wrote to memory of 5152	8	cmd.exe	91
PID 8 wrote to memory of 2560	8	cmd.exe	92
PID 8 wrote to memory of 3092	8	cmd.exe	93
PID 8 wrote to memory of 3144	8	cmd.exe	94
PID 8 wrote to memory of 5252	8	cmd.exe	95
PID 8 wrote to memory of 4432	8	cmd.exe	96
PID 8 wrote to memory of 3576	8	cmd.exe	97
PID 8 wrote to memory of 4808	8	cmd.exe	98
PID 8 wrote to memory of 5148	8	cmd.exe	99
PID 8 wrote to memory of 5456	8	cmd.exe	100
PID 8 wrote to memory of 356	8	cmd.exe	101
PID 8 wrote to memory of 4092	8	cmd.exe	102
PID 8 wrote to memory of 2260	8	cmd.exe	103
PID 8 wrote to memory of 3608	8	cmd.exe	104
PID 8 wrote to memory of 1484	8	cmd.exe	105
PID 8 wrote to memory of 2228	8	cmd.exe	106
PID 8 wrote to memory of 4880	8	cmd.exe	107
PID 8 wrote to memory of 4800	8	cmd.exe	108
PID 8 wrote to memory of 3988	8	cmd.exe	109

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Զȵ\ڿӻ.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4656
- C:\Windows\system32\timeout.exe
  timeout /T 10
  2⤵
  - Delays execution with timeout.exe
  PID:768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3272
- C:\Windows\system32\timeout.exe
  timeout /T 10
  2⤵
  - Delays execution with timeout.exe
  PID:3568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6076
- C:\Windows\system32\timeout.exe
  timeout /T 10
  2⤵
  - Delays execution with timeout.exe
  PID:3700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4004
- C:\Windows\system32\timeout.exe
  timeout /T 10
  2⤵
  - Delays execution with timeout.exe
  PID:5280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4668
- C:\Windows\system32\timeout.exe
  timeout /T 10
  2⤵
  - Delays execution with timeout.exe
  PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\system32\timeout.exe
  timeout /T 10
  2⤵
  - Delays execution with timeout.exe
  PID:5152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\system32\timeout.exe
  timeout /T 10
  2⤵
  - Delays execution with timeout.exe
  PID:3092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3144
- C:\Windows\system32\timeout.exe
  timeout /T 10
  2⤵
  - Delays execution with timeout.exe
  PID:5252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4432
- C:\Windows\system32\timeout.exe
  timeout /T 10
  2⤵
  - Delays execution with timeout.exe
  PID:3576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4808
- C:\Windows\system32\timeout.exe
  timeout /T 10
  2⤵
  - Delays execution with timeout.exe
  PID:5148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5456
- C:\Windows\system32\timeout.exe
  timeout /T 10
  2⤵
  - Delays execution with timeout.exe
  PID:356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4092
- C:\Windows\system32\timeout.exe
  timeout /T 10
  2⤵
  - Delays execution with timeout.exe
  PID:2260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3608
- C:\Windows\system32\timeout.exe
  timeout /T 10
  2⤵
  - Delays execution with timeout.exe
  PID:1484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\system32\timeout.exe
  timeout /T 10
  2⤵
  - Delays execution with timeout.exe
  PID:4880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4800
- C:\Windows\system32\timeout.exe
  timeout /T 10
  2⤵
  - Delays execution with timeout.exe
  PID:3988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...