12d8bccc8b4bf05902c0b015095db69b07dd859b577e9aa806201a082a8244ee

Analysis

geolocation tags

eueuropefrfrance
max time kernel
30s
max time network
33s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EXMPremiumTweaker.bat
Size 669KB
Sample260622-2kqtkagy3q
SHA256 12d8bccc8b4bf05902c0b015095db69b07dd859b577e9aa806201a082a8244ee
MD5 a907bfcab8903b37d8595377c3e268ed
SHA1 e521540a3bffd5567d83782628b3de6173cb9364
SHA512 bb122cd94abfe6b43b2bd86852b37212b0d6096385bad85fea47d0aa3d80ada43c8e62735db1a5561c25ad9c23a4f8681933197dcf0495e1b182061181650905
SSDEEP 3072:WDGzQbmbkAqA2xH7VkKEn14IZVvisLur+K3:WDGiVNEn14IZVvisL43
TLSH
T174E42E10A52A0272C6D5ED25AA73CD166F77BEC3E4404B10B4AEB1CE0FB7542DCBA6D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3868	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3868	powershell.exe
3868	powershell.exe
3328	WMIC.exe
3328	WMIC.exe
3328	WMIC.exe
3328	WMIC.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeIncreaseQuotaPrivilege	3328	WMIC.exe
Token: SeSecurityPrivilege	3328	WMIC.exe
Token: SeTakeOwnershipPrivilege	3328	WMIC.exe
Token: SeLoadDriverPrivilege	3328	WMIC.exe
Token: SeSystemProfilePrivilege	3328	WMIC.exe
Token: SeSystemtimePrivilege	3328	WMIC.exe
Token: SeProfSingleProcessPrivilege	3328	WMIC.exe
Token: SeIncBasePriorityPrivilege	3328	WMIC.exe
Token: SeCreatePagefilePrivilege	3328	WMIC.exe
Token: SeBackupPrivilege	3328	WMIC.exe
Token: SeRestorePrivilege	3328	WMIC.exe
Token: SeShutdownPrivilege	3328	WMIC.exe
Token: SeDebugPrivilege	3328	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3328	WMIC.exe
Token: SeRemoteShutdownPrivilege	3328	WMIC.exe
Token: SeUndockPrivilege	3328	WMIC.exe
Token: SeManageVolumePrivilege	3328	WMIC.exe
Token: 33	3328	WMIC.exe
Token: 34	3328	WMIC.exe
Token: 35	3328	WMIC.exe
Token: 36	3328	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3328	WMIC.exe
Token: SeSecurityPrivilege	3328	WMIC.exe
Token: SeTakeOwnershipPrivilege	3328	WMIC.exe
Token: SeLoadDriverPrivilege	3328	WMIC.exe
Token: SeSystemProfilePrivilege	3328	WMIC.exe
Token: SeSystemtimePrivilege	3328	WMIC.exe
Token: SeProfSingleProcessPrivilege	3328	WMIC.exe
Token: SeIncBasePriorityPrivilege	3328	WMIC.exe
Token: SeCreatePagefilePrivilege	3328	WMIC.exe
Token: SeBackupPrivilege	3328	WMIC.exe
Token: SeRestorePrivilege	3328	WMIC.exe
Token: SeShutdownPrivilege	3328	WMIC.exe
Token: SeDebugPrivilege	3328	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3328	WMIC.exe
Token: SeRemoteShutdownPrivilege	3328	WMIC.exe
Token: SeUndockPrivilege	3328	WMIC.exe
Token: SeManageVolumePrivilege	3328	WMIC.exe
Token: 33	3328	WMIC.exe
Token: 34	3328	WMIC.exe
Token: 35	3328	WMIC.exe
Token: 36	3328	WMIC.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5484 wrote to memory of 5152	5484	cmd.exe	89
PID 5484 wrote to memory of 4304	5484	cmd.exe	90
PID 5484 wrote to memory of 1556	5484	cmd.exe	91
PID 5484 wrote to memory of 3868	5484	cmd.exe	92
PID 5484 wrote to memory of 1028	5484	cmd.exe	95
PID 5484 wrote to memory of 4760	5484	cmd.exe	96
PID 5484 wrote to memory of 3432	5484	cmd.exe	97
PID 3432 wrote to memory of 3328	3432	cmd.exe	98
PID 3432 wrote to memory of 1184	3432	cmd.exe	99
PID 5484 wrote to memory of 5276	5484	cmd.exe	100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\EXMPremiumTweaker.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5484
- C:\Windows\system32\reg.exe
  Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f
  2⤵
  PID:5152
- C:\Windows\system32\reg.exe
  Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
  2⤵
  PID:4304
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
  2⤵
  PID:1556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3868
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
  2⤵
  - UAC bypass
  PID:1028
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
  2⤵
  PID:4760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path Win32_UserAccount where name="Admin" get sid | findstr "S-"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_UserAccount where name="Admin" get sid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3328
- - C:\Windows\system32\findstr.exe
    findstr "S-"
    3⤵
    PID:1184
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3868-0-0x00007FFD7D14F000-0x00007FFD7D150000-memory.dmp

Download

memory/3868-3-0x00007FFD7CFC0000-0x00007FFD7D964000-memory.dmp

Download

memory/3868-4-0x000001A0F3E50000-0x000001A0F3E72000-memory.dmp

Download

memory/3868-5-0x00007FFD7CFC0000-0x00007FFD7D964000-memory.dmp

Download

memory/3868-6-0x00007FFD7CFC0000-0x00007FFD7D964000-memory.dmp

Download

memory/3868-7-0x00007FFD7CFC0000-0x00007FFD7D964000-memory.dmp

Download

memory/3868-9-0x000001A0F4130000-0x000001A0F4220000-memory.dmp

Download

memory/3868-10-0x00007FFD7CFC0000-0x00007FFD7D964000-memory.dmp

Download