930d25ef5027dd9c2aa16a577cfba056027cb043fd7272c1972c86327d43a993

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
899s
max time network
445s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Aphrodite Ping Tweak.bat
Size 35KB
Sample260623-aeltwahw2x
SHA256 930d25ef5027dd9c2aa16a577cfba056027cb043fd7272c1972c86327d43a993
MD5 9eafc2c313d769f205360bbb46dab5b0
SHA1 77d6494b63802bd970860d6570d92446fea63fb5
SHA512 960fe6c02655e3aad6b82becf3dc159a791201161d9189cb65aa5a35343b00d27b4d0ce1d9a1220c79b9e7de73c9817c88922fc8def4bd3d6dd1732117371d8c
SSDEEP 768:y+AxDjZCvQEh1zCwdTCKyQah1zCw0pSyP3tb:SZZCvQEh1zCwdTCKyQah1zCw0kc3tb
TLSH
T162F2002024FB03B2CA8652217613E53FAA377FC395D897447CEE250E23D7D5AA8752E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery execution

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\PowerRun.exe	curl.exe
File created	C:\Windows\dmv.exe	curl.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6476	powershell.exe
6028	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6540	cmd.exe

Delays execution with timeout.exe 5 IoCs

defense_evasion

pid	Process
4364	timeout.exe
1908	timeout.exe
4620	timeout.exe
1500	timeout.exe
6520	timeout.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
5924	reg.exe
5056	reg.exe
5936	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6028	powershell.exe
6028	powershell.exe
6476	powershell.exe
6476	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6028	powershell.exe
Token: SeDebugPrivilege	6476	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 6540 wrote to memory of 5900	6540	cmd.exe	90
PID 5900 wrote to memory of 5936	5900	cmd.exe	91
PID 6540 wrote to memory of 5924	6540	cmd.exe	92
PID 6540 wrote to memory of 5948	6540	cmd.exe	93
PID 5948 wrote to memory of 5960	5948	cmd.exe	95
PID 5960 wrote to memory of 5056	5960	cmd.exe	96
PID 5948 wrote to memory of 6028	5948	cmd.exe	97
PID 5948 wrote to memory of 3184	5948	cmd.exe	100
PID 5948 wrote to memory of 6476	5948	cmd.exe	101
PID 5948 wrote to memory of 6220	5948	cmd.exe	102
PID 5948 wrote to memory of 6196	5948	cmd.exe	103
PID 5948 wrote to memory of 4708	5948	cmd.exe	104
PID 5948 wrote to memory of 2288	5948	cmd.exe	105
PID 5948 wrote to memory of 7068	5948	cmd.exe	106
PID 5948 wrote to memory of 6520	5948	cmd.exe	107
PID 5948 wrote to memory of 2196	5948	cmd.exe	108
PID 5948 wrote to memory of 7164	5948	cmd.exe	109
PID 5948 wrote to memory of 4364	5948	cmd.exe	110
PID 5948 wrote to memory of 1908	5948	cmd.exe	111
PID 5948 wrote to memory of 4620	5948	cmd.exe	112
PID 5948 wrote to memory of 1500	5948	cmd.exe	113
PID 5948 wrote to memory of 6020	5948	cmd.exe	114
PID 5948 wrote to memory of 5132	5948	cmd.exe	115
PID 5948 wrote to memory of 6536	5948	cmd.exe	116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Aphrodite Ping Tweak.bat"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:6540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c Reg query HKCU\CONSOLE /v VirtualTerminalLevel 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5900
- - C:\Windows\system32\reg.exe
    Reg query HKCU\CONSOLE /v VirtualTerminalLevel
    3⤵
    - Modifies registry key
    PID:5936
- C:\Windows\system32\reg.exe
  Reg add HKCU\CONSOLE /v VirtualTerminalLevel /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:5924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\APHROD~1.BAT"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c Reg query HKCU\CONSOLE /v VirtualTerminalLevel 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5960
  - - C:\Windows\system32\reg.exe
      Reg query HKCU\CONSOLE /v VirtualTerminalLevel
      4⤵
      Modifies registry key
      PID:5056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell.exe -command "& {Enable-ComputerRestore -Drive "C:"}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6028
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /V "SystemRestorePointCreationFrequency" /T REG_DWORD /D 0 /F
    3⤵
    PID:3184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -NoProfile -ExecutionPolicy Bypass -Command "& {Checkpoint-Computer -Description "Network RestorePoint"}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver "
    3⤵
    PID:6220
- - C:\Windows\system32\find.exe
    find "10."
    3⤵
    PID:6196
- - C:\Windows\system32\curl.exe
    curl -L https://cdn.discordapp.com/attachments/938256321759813642/1090417292564775014/dmv.exe -o "C:\Windows\dmv.exe"
    3⤵
    - Drops file in Windows directory
    PID:4708
- - C:\Windows\system32\curl.exe
    curl -L https://cdn.discordapp.com/attachments/938256321759813642/1090417292908703837/PowerRun.exe -o "C:\Windows\PowerRun.exe"
    3⤵
    - Drops file in Windows directory
    PID:2288
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:7068
- - C:\Windows\system32\timeout.exe
    timeout 5
    3⤵
    - Delays execution with timeout.exe
    PID:6520
- - C:\Windows\system32\mode.com
    MODE CON COLS=50 LINES=3
    3⤵
    PID:2196
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:7164
- - C:\Windows\system32\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4364
- - C:\Windows\system32\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1908
- - C:\Windows\system32\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:4620
- - C:\Windows\system32\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1500
- - C:\Windows\system32\mode.com
    MODE CON COLS=132 LINES=50
    3⤵
    PID:6020
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5132
- - C:\Windows\system32\reg.exe
    reg add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
    3⤵
    PID:6536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4600

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dhtmwpf1.qvu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dhtmwpf1.qvu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6028-11-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6028-8-0x000001E7257C0000-0x000001E7257E2000-memory.dmp

Download

memory/6028-9-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6028-10-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6028-0-0x00007FFEC5A1F000-0x00007FFEC5A20000-memory.dmp

Download

memory/6028-12-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6028-13-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6028-14-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6028-17-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6028-16-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download

memory/6028-6-0x00007FFEC5890000-0x00007FFEC6234000-memory.dmp

Download