72c5dfe537a3e6c8bdd966124c69e00b7a0f9564df702f561cc7af0f8c27dd21

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 02:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RunOnce.bat
Size 1KB
Sample260604-cxzjssh15p
SHA256 72c5dfe537a3e6c8bdd966124c69e00b7a0f9564df702f561cc7af0f8c27dd21
MD5 1dad23c6886785fbb98a81fa22058317
SHA1 4d990c99a67c59d53698d5a8122337b2b721de03
SHA512 2259bd74a7b9c5da79bbc293f1de52454848e4dcc06e5a210b067525ce2df9449e29d89b6372742e8f801fd617772b09f0a8b75238b1841971a0a1677e99eea5
TLSH
T1F64141263C5201348487C6A7FBB3C8126B76F083D661BB663132681E51AB44687F32EC
MD5 SHA1 SHA512 TLSH

Score

9^/10

defense_evasion evasion execution persistence ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2332	bcdedit.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 21 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\valorant.exe\MitigationOptions = 000000000001000000000000000000000000000000000000	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\valorant-win64-shipping.exe	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\valorant-win64-shipping.exe\MitigationOptions = 000000000001000000000000000000000000000000000000	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\valorant-win64-shipping.exe\EAFModules	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vgtray.exe\MitigationAuditOptions = 000000000000000000000000000000000000000000000000	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vgtray.exe\MitigationOptions = 000000000001000000000000000000000000000000000000	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vgc.exe\MitigationAuditOptions = 000000000000000000000000000000000000000000000000	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vgc.exe\MitigationOptions = 000000000001000000000000000000000000000000000000	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\valorant-win64-shipping.exe\MitigationAuditOptions = 000000000000000000000000000000000000000000000000	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vgtray.exe	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vgtray.exe\EAFModules	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vgc.exe\EAFModules	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\valorant.exe\MitigationOptions = 000000000000000000000000000000000000000000000000	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\valorant-win64-shipping.exe\MitigationOptions = 000000000000000000000000000000000000000000000000	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vgc.exe	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vgc.exe\MitigationOptions = 000000000000000000000000000000000000000000000000	powershell.exe
Key created	\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\valorant.exe	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\valorant.exe\MitigationAuditOptions = 000000000000000000000000000000000000000000000000	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\valorant.exe\EAFModules	powershell.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vgtray.exe\MitigationOptions = 000000000000000000000000000000000000000000000000	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6128	powershell.exe
5208	powershell.exe

Indicator Removal: Clear Persistence 1 TTPs 4 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\valorant.exe\EAFModules	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\valorant-win64-shipping.exe\EAFModules	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vgtray.exe\EAFModules	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vgc.exe\EAFModules	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6128	powershell.exe
6128	powershell.exe
5208	powershell.exe
5208	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6128	powershell.exe
Token: SeDebugPrivilege	5208	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5144 wrote to memory of 424	5144	cmd.exe	81
PID 5144 wrote to memory of 3248	5144	cmd.exe	82
PID 5144 wrote to memory of 4000	5144	cmd.exe	83
PID 5144 wrote to memory of 5096	5144	cmd.exe	84
PID 5144 wrote to memory of 2572	5144	cmd.exe	85
PID 5144 wrote to memory of 4364	5144	cmd.exe	86
PID 5144 wrote to memory of 6128	5144	cmd.exe	87
PID 5144 wrote to memory of 444	5144	cmd.exe	88
PID 444 wrote to memory of 5312	444	cmd.exe	89
PID 5144 wrote to memory of 5208	5144	cmd.exe	90
PID 5144 wrote to memory of 2332	5144	cmd.exe	91
PID 5144 wrote to memory of 1288	5144	cmd.exe	92
PID 5144 wrote to memory of 1224	5144	cmd.exe	93
PID 5144 wrote to memory of 6040	5144	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RunOnce.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5144
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:424
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\AtlasOS\Services\Mitigations" /v state /t REG_DWORD /d 0 /f
  2⤵
  PID:3248
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\AtlasOS\Services\Mitigations" /v path /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RunOnce.bat" /f
  2⤵
  PID:4000
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "FeatureSettingsOverride" /t REG_DWORD /d "3" /f
  2⤵
  PID:5096
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v "FeatureSettingsOverrideMask" /t REG_DWORD /d "3" /f
  2⤵
  PID:2572
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "DisableExceptionChainValidation" /t REG_DWORD /d "1" /f
  2⤵
  PID:4364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -NoP -C "Set-ProcessMitigation -System -Disable CFG"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "MitigationAuditOptions"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:444
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "MitigationAuditOptions"
    3⤵
    PID:5312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell -NoP -C "foreach ($a in $($env:enableCFGApps -split ' ')) {Set-ProcessMitigation -Name $a`.exe -Enable CFG}"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Command and Scripting Interpreter: PowerShell
  - Indicator Removal: Clear Persistence
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5208
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx OptIn
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2332
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "MitigationAuditOptions" /t REG_BINARY /d "222222222222222222222222222222222222222222222222" /f
  2⤵
  PID:1288
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" /v "MitigationOptions" /t REG_BINARY /d "222222222222222222222222222222222222222222222222" /f
  2⤵
  PID:1224
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v "ProtectionMode" /t REG_DWORD /d "0" /f
  2⤵
  PID:6040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 a4aa1e980540f6666c22daa9804220c3f6f6e284e4fae9fdcaebb4672d8e3066
MD5 2142980c582d69c74428b3e93d99b02f
SHA1 d1a641c531e71cde57a742c772c5d73a2aa8680d
SHA512 2043ebf342dc4186ee658faaec7a3687d2d656d3104b05f2aed23605ef773d9867a2d27254d290229b87dab94d4b7ca0ac5521a898cfbc7cb8eac0cded585590
TLSH
T10671BD323375B1D489563F07192C198463BF8356EA54AF4CB65C624EE92B04BDF222F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 51f78dd063d1686b6609aa49580ac3c55e18abcf72d392d1c776d937382da703
MD5 d5fda7b0ec609af3ea450f8f887e1fd4
SHA1 127f277b3571ac152f85ef6258094303b72a3a8d
SHA512 0a2fcfe8e86b1d99bb71d40c6494bdb711118663ed8f43c71ddbd9fffb0eeb12ca2a732aa243451d0d88890cf3bb348989910850c3e1a225dae9ed05d7d51c7c
TLSH
T18241DC33F3ADD4E5C8851D7A20C8AD01767586F704DA9EDB2780C50DA12F9AACB505AC
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_slbj3fjf.plq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_slbj3fjf.plq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6128-17-0x00000200F8820000-0x00000200F883C000-memory.dmp

Download

memory/6128-9-0x00000200F3B90000-0x00000200F3BA0000-memory.dmp

Download

memory/6128-10-0x00007FF434BA0000-0x00007FF434BB0000-memory.dmp

Download

memory/6128-0-0x00000200F3B90000-0x00000200F3BA0000-memory.dmp

Download

memory/6128-18-0x00000200F8840000-0x00000200F88F3000-memory.dmp

Download

memory/6128-19-0x00000200F8900000-0x00000200F890A000-memory.dmp

Download

memory/6128-20-0x00000200F8930000-0x00000200F894C000-memory.dmp

Download

memory/6128-21-0x00000200F8950000-0x00000200F896E000-memory.dmp

Download

memory/6128-4-0x00000200F8770000-0x00000200F8792000-memory.dmp

Download

memory/6128-1-0x00000200F3B90000-0x00000200F3BA0000-memory.dmp

Download