e5053a99dafdc8151050f60d7429fca37c20bcef688d808f8b65093a1dca5841

Analysis

max time kernel
149s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WindowsDefanderUpdater.bat
Size 26KB
Sample260705-lfggbsbt71
SHA256 e5053a99dafdc8151050f60d7429fca37c20bcef688d808f8b65093a1dca5841
MD5 2fa9ec7c7514466f4e2d3aa09b6c6d48
SHA1 9d2d50b9b8f9e7ad2abb48abaa0ae6d9ff6e50f3
SHA512 3deb828c26a62023e6e4b0090447e95d321329e5cc1e9b9fca63df144ced45128379243732f8964663b26947e9899166e3c54306e9e81cf908548dee06f54417
SSDEEP 384:P92rNpVpdsEMDwL8Lbzg/LCS1LE/JAPrCXLQsn7fRAO31DSjaJrNd/u9SIER:aNpVpCENIXcR14/O6H1DSUdCNQ
TLSH
T1A8C274393574E624A39267BFDD76C498BE2763EF15369C04B88F82F117482D5B3AC205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2716	powershell.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
3500	timeout.exe
5196	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2716	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2716	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 3040	4264	cmd.exe	89
PID 4264 wrote to memory of 3500	4264	cmd.exe	90
PID 4264 wrote to memory of 2716	4264	cmd.exe	91
PID 4264 wrote to memory of 5196	4264	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\WindowsDefanderUpdater.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:3040
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\ultimate_harvester.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- C:\Windows\system32\timeout.exe
  timeout /t 3 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2716-0-0x00007FFDD708F000-0x00007FFDD7090000-memory.dmp

Download

memory/2716-3-0x00007FFDD6F00000-0x00007FFDD78A4000-memory.dmp

Download

memory/2716-5-0x00007FFDD6F00000-0x00007FFDD78A4000-memory.dmp

Download

memory/2716-4-0x0000023BBD260000-0x0000023BBD282000-memory.dmp

Download

memory/2716-7-0x00007FFDD6F00000-0x00007FFDD78A4000-memory.dmp

Download

memory/2716-8-0x00007FFDD6F00000-0x00007FFDD78A4000-memory.dmp

Download