5fc403ea3b11d9ead9c9c81c11cf3839a451c323a04604122ca2642965cc2f42

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Զȵ/÷exeʧЧʱ.cmd
Size 335B
Sample260601-phbkmsdv5l
SHA256 5fc403ea3b11d9ead9c9c81c11cf3839a451c323a04604122ca2642965cc2f42
MD5 24960b399754cb639540fb641f825a6c
SHA1 65807fafd285325290abc93d68ed509d93ad3538
SHA512 790b1edee8a1d765ce42607857b7f45c2d7a744dd75fcee4a73c6796c910283e72ccab12e6e7618121e8a8b16afa3b2328ab1bd40dd7a546356617be19828a2d
TLSH
T1A8E078409D35C5DD65B7541A36335555FE476143B00CD31231D05874375E7DACB2A0D6
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	mshta.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
720	powershell.exe
2000	powershell.exe
2804	powershell.exe
4652	powershell.exe
1376	powershell.exe
4964	powershell.exe
4820	powershell.exe
3200	powershell.exe
4156	powershell.exe
1560	powershell.exe
3808	powershell.exe
2164	powershell.exe
4136	powershell.exe
4796	powershell.exe
2572	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 15 IoCs

defense_evasion

pid	Process
3364	timeout.exe
4964	timeout.exe
4504	timeout.exe
896	timeout.exe
2772	timeout.exe
4324	timeout.exe
3820	timeout.exe
1836	timeout.exe
2896	timeout.exe
3504	timeout.exe
1788	timeout.exe
3928	timeout.exe
5092	timeout.exe
764	timeout.exe
4556	timeout.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
4156	powershell.exe
4156	powershell.exe
720	powershell.exe
720	powershell.exe
1560	powershell.exe
1560	powershell.exe
2164	powershell.exe
2164	powershell.exe
4964	powershell.exe
4964	powershell.exe
4964	powershell.exe
4820	powershell.exe
4820	powershell.exe
4136	powershell.exe
4136	powershell.exe
2000	powershell.exe
2000	powershell.exe
2804	powershell.exe
2804	powershell.exe
4652	powershell.exe
4652	powershell.exe
4796	powershell.exe
4796	powershell.exe
1376	powershell.exe
1376	powershell.exe
3808	powershell.exe
3808	powershell.exe
2572	powershell.exe
2572	powershell.exe
3200	powershell.exe
3200	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeDebugPrivilege	720	powershell.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeDebugPrivilege	4820	powershell.exe
Token: SeDebugPrivilege	4136	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	4652	powershell.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	3808	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	3200	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 2016	1132	cmd.exe	88
PID 2016 wrote to memory of 4336	2016	mshta.exe	89
PID 4336 wrote to memory of 4156	4336	cmd.exe	92
PID 4336 wrote to memory of 4556	4336	cmd.exe	95
PID 4336 wrote to memory of 720	4336	cmd.exe	99
PID 4336 wrote to memory of 3820	4336	cmd.exe	100
PID 4336 wrote to memory of 1560	4336	cmd.exe	101
PID 4336 wrote to memory of 3364	4336	cmd.exe	102
PID 4336 wrote to memory of 2164	4336	cmd.exe	105
PID 4336 wrote to memory of 1788	4336	cmd.exe	106
PID 4336 wrote to memory of 4964	4336	cmd.exe	113
PID 4336 wrote to memory of 1836	4336	cmd.exe	114
PID 4336 wrote to memory of 4820	4336	cmd.exe	115
PID 4336 wrote to memory of 2896	4336	cmd.exe	116
PID 4336 wrote to memory of 4136	4336	cmd.exe	117
PID 4336 wrote to memory of 3928	4336	cmd.exe	118
PID 4336 wrote to memory of 2000	4336	cmd.exe	122
PID 4336 wrote to memory of 5092	4336	cmd.exe	123
PID 4336 wrote to memory of 2804	4336	cmd.exe	124
PID 4336 wrote to memory of 4964	4336	cmd.exe	125
PID 4336 wrote to memory of 4652	4336	cmd.exe	126
PID 4336 wrote to memory of 896	4336	cmd.exe	127
PID 4336 wrote to memory of 4796	4336	cmd.exe	128
PID 4336 wrote to memory of 2772	4336	cmd.exe	129
PID 4336 wrote to memory of 1376	4336	cmd.exe	134
PID 4336 wrote to memory of 4324	4336	cmd.exe	135
PID 4336 wrote to memory of 3808	4336	cmd.exe	136
PID 4336 wrote to memory of 4504	4336	cmd.exe	137
PID 4336 wrote to memory of 2572	4336	cmd.exe	138
PID 4336 wrote to memory of 764	4336	cmd.exe	139
PID 4336 wrote to memory of 3200	4336	cmd.exe	145
PID 4336 wrote to memory of 3504	4336	cmd.exe	146

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Զȵ\÷exeʧЧʱ.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\system32\mshta.exe
  mshta vbscript:createobject("wscript.shell").run("""÷exeʧЧʱ.cmd"" h",0)(window.close)
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Զȵ\÷exeʧЧʱ.cmd" h"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4156
  - - C:\Windows\system32\timeout.exe
      timeout /T 10
      4⤵
      Delays execution with timeout.exe
      PID:4556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:720
  - - C:\Windows\system32\timeout.exe
      timeout /T 10
      4⤵
      Delays execution with timeout.exe
      PID:3820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1560
  - - C:\Windows\system32\timeout.exe
      timeout /T 10
      4⤵
      Delays execution with timeout.exe
      PID:3364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2164
  - - C:\Windows\system32\timeout.exe
      timeout /T 10
      4⤵
      Delays execution with timeout.exe
      PID:1788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4964
  - - C:\Windows\system32\timeout.exe
      timeout /T 10
      4⤵
      Delays execution with timeout.exe
      PID:1836
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4820
  - - C:\Windows\system32\timeout.exe
      timeout /T 10
      4⤵
      Delays execution with timeout.exe
      PID:2896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4136
  - - C:\Windows\system32\timeout.exe
      timeout /T 10
      4⤵
      Delays execution with timeout.exe
      PID:3928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2000
  - - C:\Windows\system32\timeout.exe
      timeout /T 10
      4⤵
      Delays execution with timeout.exe
      PID:5092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2804
  - - C:\Windows\system32\timeout.exe
      timeout /T 10
      4⤵
      Delays execution with timeout.exe
      PID:4964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4652
  - - C:\Windows\system32\timeout.exe
      timeout /T 10
      4⤵
      Delays execution with timeout.exe
      PID:896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4796
  - - C:\Windows\system32\timeout.exe
      timeout /T 10
      4⤵
      Delays execution with timeout.exe
      PID:2772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1376
  - - C:\Windows\system32\timeout.exe
      timeout /T 10
      4⤵
      Delays execution with timeout.exe
      PID:4324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3808
  - - C:\Windows\system32\timeout.exe
      timeout /T 10
      4⤵
      Delays execution with timeout.exe
      PID:4504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2572
  - - C:\Windows\system32\timeout.exe
      timeout /T 10
      4⤵
      Delays execution with timeout.exe
      PID:764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -command "& {set-executionpolicy Remotesigned -Scope Process; .'.\wifi.ps1' }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3200
  - - C:\Windows\system32\timeout.exe
      timeout /T 10
      4⤵
      Delays execution with timeout.exe
      PID:3504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...