Overview

overview

7

Static

static

1

Platinum+O...V3.bat

windows10-2004-x64

7

Platinum+O...V3.bat

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    30s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/06/2026, 22:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Platinum+Optimizer.8.5.Beta.V3.bat
  • Size 1.9MB
  • Sample260621-2q4ydagx21
  • SHA256 bbc852e6ef779ba37b7e3c30ad86fcf3de3a8107589c7199014db5a04b2b391f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionexecutionpersistenceransomware

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Platinum+Optimizer.8.5.Beta.V3.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5612
    • C:\Windows\system32\chcp.com
      chcp 65001
      2⤵
        PID:4884
      • C:\Windows\system32\fltMC.exe
        fltmc
        2⤵
          PID:7108
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -command "$p=Add-Type -MemberDefinition '[DllImport(\"user32.dll\")] public static extern IntPtr GetSystemMenu(IntPtr hWnd, bool bRevert); [DllImport(\"user32.dll\")] public static extern bool DeleteMenu(IntPtr hMenu, uint uPos, uint uFlags); [DllImport(\"kernel32.dll\")] public static extern IntPtr GetConsoleWindow();' -Name 'Win32' -PassThru; $hwnd=$p::GetConsoleWindow(); $menu=$p::GetSystemMenu($hwnd, 0); $p::DeleteMenu($menu, 0xF060, 0x0);"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2624
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gouivpwq\gouivpwq.cmdline"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:6016
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A66.tmp" "c:\Users\Admin\AppData\Local\Temp\gouivpwq\CSC96C06BF5CAE4F379250AE16B73A64E9.TMP"
              4⤵
                PID:4908
          • C:\Windows\system32\timeout.exe
            timeout /t 7 /nobreak
            2⤵
            • Delays execution with timeout.exe
            PID:4876
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Enable-ComputerRestore -Drive 'C:' -ErrorAction SilentlyContinue"
            2⤵
            • Hide Artifacts: Ignore Process Interrupts
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4724
          • C:\Windows\system32\sc.exe
            sc config vss start= demand
            2⤵
            • Launches sc.exe
            PID:5360
          • C:\Windows\system32\net.exe
            net start vss
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2784
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 start vss
              3⤵
                PID:1296
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "Checkpoint-Computer -Description 'Platinum+ Optimizer Restore Point' -RestorePointType 'MODIFY_SETTINGS'"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1768
            • C:\Windows\regedit.exe
              regedit /E "C:\Users\Admin\Desktop\Platinum_Optimizer_Backup.reg"
              2⤵
              • Checks BIOS information in registry
              • Checks processor information in registry
              • Enumerates system info in registry
              • Runs .reg file with regedit
              PID:6492
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:1948
          • C:\Windows\system32\srtasks.exe
            C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
            1⤵
              PID:3400

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 3674b90c1caf1df47ef6cdfcff99b7987586cab16fe77bbe8318ca09a0cd9a77
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  RES9A66.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\RES9A66.tmp
                  • Size 1KB
                  • SHA256 61c7b44ae40c4cbde202a3e23fad8ab0dff18a772500278d9538fa44594ce79d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  __PSScriptPolicyTest_nfomu15h.qtv.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nfomu15h.qtv.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  gouivpwq.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\gouivpwq\gouivpwq.dll
                  • Size 3KB
                  • SHA256 2fc53a6e1784ebbc024ffa7c1032558de6619f406c97a7bdb909c2f863998cfa
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  CSC96C06BF5CAE4F379250AE16B73A64E9.TMP
                  • Path \??\c:\Users\Admin\AppData\Local\Temp\gouivpwq\CSC96C06BF5CAE4F379250AE16B73A64E9.TMP
                  • Size 652B
                  • SHA256 31e6cf120f7b8cc5baf6ca9a8f2cb242c0e1b6fa6e28195340e9a04921c0ab5d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  gouivpwq.0.cs
                  • Path \??\c:\Users\Admin\AppData\Local\Temp\gouivpwq\gouivpwq.0.cs
                  • Size 442B
                  • SHA256 76dfe531356030b41c396a4680cfd2e1808692a546fd98f61662e80c094035df
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  gouivpwq.cmdline
                  • Path \??\c:\Users\Admin\AppData\Local\Temp\gouivpwq\gouivpwq.cmdline
                  • Size 369B
                  • SHA256 db716b93f72c019af0d6faf76777b1e94a8a66e4a5641dd212be581c8fa533d9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/2624-0-0x00007FF9916CF000-0x00007FF9916D0000-memory.dmp
                  Download

                  memory/2624-17-0x00007FF991540000-0x00007FF991EE4000-memory.dmp
                  Download

                  memory/2624-11-0x00007FF991540000-0x00007FF991EE4000-memory.dmp
                  Download

                  memory/2624-26-0x000001F165600000-0x000001F165608000-memory.dmp
                  Download

                  memory/2624-10-0x00007FF991540000-0x00007FF991EE4000-memory.dmp
                  Download

                  memory/2624-9-0x00007FF991540000-0x00007FF991EE4000-memory.dmp
                  Download

                  memory/2624-20-0x00007FF991540000-0x00007FF991EE4000-memory.dmp
                  Download

                  memory/2624-28-0x00007FF991540000-0x00007FF991EE4000-memory.dmp
                  Download

                  memory/2624-8-0x00007FF991540000-0x00007FF991EE4000-memory.dmp
                  Download

                  memory/2624-6-0x000001F17D720000-0x000001F17D742000-memory.dmp
                  Download