37af4c4519fe8fe3331d56e74ff2be57c09a46041b32c5a3233acc243b456945

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/06/2026, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TraceX Final/Run-TraceX-HWID-Spoofer.bat
Size 6KB
Sample260608-yd7lysew21
SHA256 37af4c4519fe8fe3331d56e74ff2be57c09a46041b32c5a3233acc243b456945
MD5 4f98523504c362ef51a4c82768e8b51a
SHA1 8d3c001925d58761b5707f8a10d662d7b77416c6
SHA512 95baf291c47eb91da07ba20025df0c93b54e9b06bc1afd5f2090a991ade6b50a88083472543377d1b8f6c55b50c9e0d8ec231735114291b02b5997f2972dbbfb
SSDEEP 192:H55Iq2WQKBJ+mglJIqL1WRDK6DFD66DFOQDF:Z/QNPGe6pW65OQZ
TLSH
T1A3D12122342E97760ABED52884250069F55A62CF61085EFDF1AFD1781F38384DBFE5C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3532	powershell.exe
976	powershell.exe
2320	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
976	powershell.exe
976	powershell.exe
2320	powershell.exe
2320	powershell.exe
3532	powershell.exe
3532	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	976	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeDebugPrivilege	3532	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 2452	3680	cmd.exe	88
PID 3680 wrote to memory of 4728	3680	cmd.exe	89
PID 4728 wrote to memory of 976	4728	cmd.exe	90
PID 3680 wrote to memory of 2320	3680	cmd.exe	91
PID 3680 wrote to memory of 3532	3680	cmd.exe	93
PID 3680 wrote to memory of 1824	3680	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TraceX Final\Run-TraceX-HWID-Spoofer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:2452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Get-ExecutionPolicy -Scope CurrentUser" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-ExecutionPolicy -Scope CurrentUser"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$blocked = Get-ChildItem -Path 'C:\Users\Admin\AppData\Local\Temp\TraceX Final\' -Recurse | Where-Object { $_.IsBlocked }; if ($blocked) { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Write-Host 'Test' | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3532
- C:\Windows\system32\choice.exe
  choice /C YN /M "Would you like to configure PowerShell now"
  2⤵
  PID:1824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 00ae5433c0107cc164516c7849b4cff7b6faeb52e5afa65c01dbd8c7a5efe397
MD5 d136d3411d4aa688242c53cafb993aa6
SHA1 1a81cc78e3ca445d5a5193e49ddce26d5e25179f
SHA512 282ea53f8093c00e8c64d253782068211f8c4187391d5078755f55dedb8825c0042173d82f489d7b6c06e88184b70e83c1e92dadb80f57bd96c95855ac6b3da1
TLSH
T16651EE323375B1E888167F071E68598053BF4355FA94AF0CB698621EDE2741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 4ee75b9bd85c06e1b58c54155ab27230c46345559d353fb0582a9592839432f1
MD5 67c92df588047cbc080a443367781b38
SHA1 7d5fe87cce0d407a82ba29da7ec1a441fac44a74
SHA512 47e99be1e08cc677ac24b14d55ac5c6f63f115c441e29bb1ce316673a199df23522bfd0dc615d05d397bb1a99cfb76044a88421702d4ca5b056bd803d690e5af
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 daa246f73567ad176e744abdb82d991dd8cffe0e2d847d2feefeb84f7fa5f882
MD5 2238871af228384f4b8cdc65117ba9f1
SHA1 2a200725f1f32e5a12546aa7fd7a8c5906757bd1
SHA512 1833d508fdbe2b8722b787bfc0c1848a5bcdeb7ec01e94158d78e9e6ceb397a2515d88bb8ca4ec1a810263fc900b5b1ea1d788aa103967ed61436e617fab47bf
TLSH
T15F115323B39C89A1CC96163A509D9C1172B682C7819EDFDF6BC0C205A1BF598CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_trbu5bmw.b33.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_trbu5bmw.b33.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/976-1-0x0000020E81C90000-0x0000020E81CA0000-memory.dmp

Download

memory/976-0-0x0000020E81C90000-0x0000020E81CA0000-memory.dmp

Download

memory/976-9-0x0000020EFFEF0000-0x0000020EFFF12000-memory.dmp

Download

memory/2320-14-0x0000023879750000-0x0000023879760000-memory.dmp

Download

memory/2320-13-0x0000023879750000-0x0000023879760000-memory.dmp

Download