37af4c4519fe8fe3331d56e74ff2be57c09a46041b32c5a3233acc243b456945

Analysis

max time kernel
149s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TraceX Final/Run-TraceX-HWID-Spoofer.bat
Size 6KB
Sample260608-yd7lysew21
SHA256 37af4c4519fe8fe3331d56e74ff2be57c09a46041b32c5a3233acc243b456945
MD5 4f98523504c362ef51a4c82768e8b51a
SHA1 8d3c001925d58761b5707f8a10d662d7b77416c6
SHA512 95baf291c47eb91da07ba20025df0c93b54e9b06bc1afd5f2090a991ade6b50a88083472543377d1b8f6c55b50c9e0d8ec231735114291b02b5997f2972dbbfb
SSDEEP 192:H55Iq2WQKBJ+mglJIqL1WRDK6DFD66DFOQDF:Z/QNPGe6pW65OQZ
TLSH
T1A3D12122342E97760ABED52884250069F55A62CF61085EFDF1AFD1781F38384DBFE5C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5184	powershell.exe
4392	powershell.exe
1708	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4392	powershell.exe
4392	powershell.exe
1708	powershell.exe
1708	powershell.exe
5184	powershell.exe
5184	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4392	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	5184	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5968 wrote to memory of 5068	5968	cmd.exe	81
PID 5968 wrote to memory of 4264	5968	cmd.exe	82
PID 4264 wrote to memory of 4392	4264	cmd.exe	83
PID 5968 wrote to memory of 1708	5968	cmd.exe	84
PID 5968 wrote to memory of 5184	5968	cmd.exe	85
PID 5968 wrote to memory of 5788	5968	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TraceX Final\Run-TraceX-HWID-Spoofer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5968
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Get-ExecutionPolicy -Scope CurrentUser" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-ExecutionPolicy -Scope CurrentUser"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$blocked = Get-ChildItem -Path 'C:\Users\Admin\AppData\Local\Temp\TraceX Final\' -Recurse | Where-Object { $_.IsBlocked }; if ($blocked) { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Write-Host 'Test' | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5184
- C:\Windows\system32\choice.exe
  choice /C YN /M "Would you like to configure PowerShell now"
  2⤵
  PID:5788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 a4aa1e980540f6666c22daa9804220c3f6f6e284e4fae9fdcaebb4672d8e3066
MD5 2142980c582d69c74428b3e93d99b02f
SHA1 d1a641c531e71cde57a742c772c5d73a2aa8680d
SHA512 2043ebf342dc4186ee658faaec7a3687d2d656d3104b05f2aed23605ef773d9867a2d27254d290229b87dab94d4b7ca0ac5521a898cfbc7cb8eac0cded585590
TLSH
T10671BD323375B1D489563F07192C198463BF8356EA54AF4CB65C624EE92B04BDF222F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7983b690ed13b011fdc38efa7dd42507fcf61f11e79504974e59de3b9a723917
MD5 4d3ae05b4fab5f9d7b3692aa11507e73
SHA1 350cb66f0ec5e3380629606998d68bf100e988e9
SHA512 8c7ce0cb8f7dacf37a897f01cb76f565a12048eb00c1753a3bfdad611d93c95300aa31f2194a3b368435b1fe21b4b2e60528c962b2d49c7ee2e50f001ddfe24b
TLSH
T177218633B7ECC134C8D911BA208CAD01B2B6C3C7449ECE8B7B84C518A57F98ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 173a33c960a448240aeb8fe3d2d9831841e5bf7664bac64dd4355096bde3e64e
MD5 890bac1ee3b2f973f0d8e61a600d16ec
SHA1 2ce9388bc743d2976aea72622a593b2971c2bf24
SHA512 1231ffa39f91de58b9a0e43507ae3e82ebaed77dd4e58211c8bd39ba7eeef48dd1d9e1cf9a2dd5d2a746dfffbb07fcc95edbdf02aa0d6996f39fee9bcfd5adbb
TLSH
T1F811BA33B39CC134C8D9017A1088AD01B1B0C3C7009ECE8F7B84C109E57F89ADB601E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_phrfxxou.sqx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_phrfxxou.sqx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1708-23-0x000001E14AA60000-0x000001E14AA70000-memory.dmp

Download

memory/1708-24-0x000001E14AA60000-0x000001E14AA70000-memory.dmp

Download

memory/4392-9-0x00007FF441FE0000-0x00007FF441FF0000-memory.dmp

Download

memory/4392-16-0x0000022373340000-0x000002237335C000-memory.dmp

Download

memory/4392-17-0x0000022373360000-0x0000022373413000-memory.dmp

Download

memory/4392-18-0x0000022373420000-0x000002237342A000-memory.dmp

Download

memory/4392-19-0x0000022373450000-0x000002237346C000-memory.dmp

Download

memory/4392-0-0x00000223711C0000-0x00000223711D0000-memory.dmp

Download

memory/4392-4-0x00000223732B0000-0x00000223732D2000-memory.dmp

Download

memory/4392-1-0x00000223711C0000-0x00000223711D0000-memory.dmp

Download