Analysis
- max time kernel
148s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 09:29
General
- Target Microsoft-Activation-Scripts.bat
- Size 4.7MB
- Sample260705-lf31bsbt8t
- SHA256 6ca225a3a2b0becac915dc5b9ab44741630f4a75af39d4b10a8b87e091100f10
Malware Config
Signatures
- Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
- Deletes itself 1 IoCs
- Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650012⤵
-
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts.bat" /launched2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\Microsoft-Activation-Scripts.bat /launched3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Windows\system32\PING.EXEping -n 6 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "& ([scriptblock]::Create($env:_qj))"4⤵
- Badlisted process makes network request
- Deletes itself
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3344-0-0x00007FF9F88DF000-0x00007FF9F88E0000-memory.dmp
memory/3344-3-0x000001E7F4210000-0x000001E7F4232000-memory.dmp
memory/3344-4-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/3344-5-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/3344-6-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/3344-7-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/3344-8-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/3344-9-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/3344-10-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/3344-11-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/3344-12-0x000001E7F42B0000-0x000001E7F42C2000-memory.dmp
memory/3344-13-0x000001E7F42A0000-0x000001E7F42AA000-memory.dmp
memory/3344-14-0x000001E7F4300000-0x000001E7F432A000-memory.dmp
memory/3344-15-0x000001E7F4330000-0x000001E7F4338000-memory.dmp
memory/3344-16-0x000001E7F44B0000-0x000001E7F44D6000-memory.dmp
memory/3344-17-0x000001E7F4340000-0x000001E7F434A000-memory.dmp
memory/3344-18-0x000001E7F4720000-0x000001E7F4762000-memory.dmp
memory/3344-19-0x000001E7F4760000-0x000001E7F481E000-memory.dmp
memory/3344-20-0x000001E7F4820000-0x000001E7F48A0000-memory.dmp
memory/3344-21-0x000001E7F48A0000-0x000001E7F4D78000-memory.dmp
memory/3344-22-0x000001E7F4D80000-0x000001E7F5456000-memory.dmp
memory/3344-23-0x000001E7F5460000-0x000001E7F547A000-memory.dmp
memory/3344-24-0x000001E7F44F0000-0x000001E7F44F6000-memory.dmp
memory/3344-25-0x000001E7F5480000-0x000001E7F54A6000-memory.dmp
memory/3344-26-0x000001E7F44F0000-0x000001E7F44F8000-memory.dmp
memory/3344-27-0x000001E7F54B0000-0x000001E7F54DA000-memory.dmp
memory/3344-28-0x000001E7F5F00000-0x000001E7F5F08000-memory.dmp
memory/3344-29-0x000001E7F4500000-0x000001E7F4508000-memory.dmp
memory/3344-30-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/3344-31-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/3344-32-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/3344-33-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/3344-34-0x000001E7F44E0000-0x000001E7F44EA000-memory.dmp
memory/3344-35-0x000001E7F42D0000-0x000001E7F42FD000-memory.dmp
memory/3344-37-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/3344-41-0x000001E7F5F10000-0x000001E7F623C000-memory.dmp
memory/3344-42-0x000001E7F5F10000-0x000001E7F6235000-memory.dmp
memory/3344-43-0x000001E7F5F10000-0x000001E7F6235000-memory.dmp
memory/3344-46-0x000001E7DBE80000-0x000001E7DBEE6000-memory.dmp
memory/3344-49-0x000001E7F42D0000-0x000001E7F42FD000-memory.dmp
memory/3344-50-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp