Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 12:17
General
- Target Contract_Invoice/fix_lnk.bat
- Size 466B
- Sample260708-pgdzdaft9x
- SHA256 b0df35d527a135a3008a3e34a323e8f726a17011a90f309a83d71bbd7eefa8d4
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Contract_Invoice\fix_lnk.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -Command "$ws = New-Object -ComObject WScript.Shell; $lnk = $ws.CreateShortcut('C:\Users\Admin\AppData\Local\Temp\Contract_Invoice\\launch.lnk'); $lnk.TargetPath = 'C:\\Windows\\System32\\cmd.exe'; $lnk.Arguments = '/c launcher.bat'; $lnk.WorkingDirectory = 'C:\Users\Admin\AppData\Local\Temp\Contract_Invoice'; $lnk.WindowStyle = 7; $lnk.IconLocation = 'C:\Users\Admin\AppData\Local\Temp\Contract_Invoice\app.ico,0'; $lnk.Description = 'Launch Setup'; $lnk.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5088-0-0x00007FFC0F9AF000-0x00007FFC0F9B0000-memory.dmp
memory/5088-3-0x0000028C52FF0000-0x0000028C53012000-memory.dmp
memory/5088-4-0x00007FFC0F820000-0x00007FFC101C4000-memory.dmp
memory/5088-5-0x00007FFC0F820000-0x00007FFC101C4000-memory.dmp
memory/5088-7-0x00007FFC0F820000-0x00007FFC101C4000-memory.dmp
memory/5088-6-0x00007FFC0F820000-0x00007FFC101C4000-memory.dmp
memory/5088-8-0x00007FFC0F820000-0x00007FFC101C4000-memory.dmp
memory/5088-9-0x00007FFC0F820000-0x00007FFC101C4000-memory.dmp
memory/5088-11-0x00007FFC0F820000-0x00007FFC101C4000-memory.dmp
memory/5088-10-0x00007FFC0F820000-0x00007FFC101C4000-memory.dmp
memory/5088-12-0x00007FFC0F820000-0x00007FFC101C4000-memory.dmp
memory/5088-16-0x00007FFC0F820000-0x00007FFC101C4000-memory.dmp
memory/5088-17-0x00007FFC0F820000-0x00007FFC101C4000-memory.dmp
memory/5088-13-0x00007FFC0F820000-0x00007FFC101C4000-memory.dmp