Analysis
- max time kernel
308s - max time network
315s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
11/07/2026, 14:30
General
- Target Start Windows.bat
- Size 1019B
- Sample260711-rt6k9set5t
- SHA256 c62dad4d5ba783441de8bb07766a12e2864e3400ce850914bf14977d9657030a
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Start Windows.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\files\Update-Tenacity.ps1" -Root "C:\Users\Admin\AppData\Local\Temp\." -Repo "xoo0524tw/Tenacity-Launcher"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\files\jre\bin\java.exe"C:\Users\Admin\AppData\Local\Temp\files\jre\bin\java.exe" -noverify -Djava.library.path="..\files\natives" -cp "..\Tenacity.jar;..\files\libs\*" net.minecraft.client.main.Main --version Tenacity --accessToken 0 --userProperties {} --gameDir "." --assetsDir "..\files\assets" --assetIndex 1.8 --width 854 --height 4802⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_dwid4gw3.waz.ps1
memory/616-118-0x00000000027F0000-0x0000000002800000-memory.dmp
memory/616-178-0x00000000028F0000-0x0000000002900000-memory.dmp
memory/616-28-0x0000000002630000-0x0000000002640000-memory.dmp
memory/616-30-0x0000000002640000-0x0000000002650000-memory.dmp
memory/616-188-0x0000000002630000-0x0000000002640000-memory.dmp
memory/616-32-0x0000000002650000-0x0000000002660000-memory.dmp
memory/616-34-0x0000000002660000-0x0000000002670000-memory.dmp
memory/616-37-0x0000000002670000-0x0000000002680000-memory.dmp
memory/616-39-0x0000000002680000-0x0000000002690000-memory.dmp
memory/616-41-0x0000000002690000-0x00000000026A0000-memory.dmp
memory/616-43-0x00000000026A0000-0x00000000026B0000-memory.dmp
memory/616-45-0x00000000026B0000-0x00000000026C0000-memory.dmp
memory/616-50-0x00000000026C0000-0x00000000026D0000-memory.dmp
memory/616-49-0x00000000023C0000-0x0000000002630000-memory.dmp
memory/616-53-0x00000000026D0000-0x00000000026E0000-memory.dmp
memory/616-52-0x0000000002630000-0x0000000002640000-memory.dmp
memory/616-57-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/616-56-0x0000000002640000-0x0000000002650000-memory.dmp
memory/616-63-0x0000000002700000-0x0000000002710000-memory.dmp
memory/616-62-0x0000000002660000-0x0000000002670000-memory.dmp
memory/616-60-0x00000000026F0000-0x0000000002700000-memory.dmp
memory/616-59-0x0000000002650000-0x0000000002660000-memory.dmp
memory/616-67-0x0000000002710000-0x0000000002720000-memory.dmp
memory/616-66-0x0000000002670000-0x0000000002680000-memory.dmp
memory/616-70-0x0000000002720000-0x0000000002730000-memory.dmp
memory/616-69-0x0000000002680000-0x0000000002690000-memory.dmp
memory/616-72-0x0000000002690000-0x00000000026A0000-memory.dmp
memory/616-73-0x0000000002730000-0x0000000002740000-memory.dmp
memory/616-76-0x0000000002740000-0x0000000002750000-memory.dmp
memory/616-75-0x00000000026A0000-0x00000000026B0000-memory.dmp
memory/616-80-0x00000000026B0000-0x00000000026C0000-memory.dmp
memory/616-81-0x0000000002750000-0x0000000002760000-memory.dmp
memory/616-88-0x0000000002760000-0x0000000002770000-memory.dmp
memory/616-87-0x00000000026C0000-0x00000000026D0000-memory.dmp
memory/616-92-0x0000000002770000-0x0000000002780000-memory.dmp
memory/616-91-0x00000000026D0000-0x00000000026E0000-memory.dmp
memory/616-93-0x0000000000610000-0x0000000000611000-memory.dmp
memory/616-99-0x0000000002780000-0x0000000002790000-memory.dmp
memory/616-102-0x0000000002700000-0x0000000002710000-memory.dmp
memory/616-101-0x00000000027A0000-0x00000000027B0000-memory.dmp
memory/616-100-0x00000000026F0000-0x0000000002700000-memory.dmp
memory/616-98-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/616-97-0x00000000026E0000-0x00000000026F0000-memory.dmp
memory/616-104-0x0000000002710000-0x0000000002720000-memory.dmp
memory/616-108-0x00000000027C0000-0x00000000027D0000-memory.dmp
memory/616-107-0x0000000002720000-0x0000000002730000-memory.dmp
memory/616-105-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/616-111-0x00000000027D0000-0x00000000027E0000-memory.dmp
memory/616-115-0x00000000027E0000-0x00000000027F0000-memory.dmp
memory/616-16-0x00000000023C0000-0x0000000002630000-memory.dmp
memory/616-25-0x0000000000610000-0x0000000000611000-memory.dmp
memory/616-117-0x0000000002750000-0x0000000002760000-memory.dmp
memory/616-144-0x00000000027D0000-0x00000000027E0000-memory.dmp
memory/616-128-0x0000000002790000-0x00000000027A0000-memory.dmp
memory/616-130-0x0000000002830000-0x0000000002840000-memory.dmp
memory/616-132-0x0000000002840000-0x0000000002850000-memory.dmp
memory/616-129-0x0000000002780000-0x0000000002790000-memory.dmp
memory/616-124-0x0000000002810000-0x0000000002820000-memory.dmp
memory/616-123-0x0000000002800000-0x0000000002810000-memory.dmp
memory/616-122-0x0000000002760000-0x0000000002770000-memory.dmp
memory/616-114-0x0000000002740000-0x0000000002750000-memory.dmp
memory/616-110-0x0000000002730000-0x0000000002740000-memory.dmp
memory/616-135-0x0000000002850000-0x0000000002860000-memory.dmp
memory/616-134-0x00000000027A0000-0x00000000027B0000-memory.dmp
memory/616-137-0x00000000027B0000-0x00000000027C0000-memory.dmp
memory/616-138-0x0000000002860000-0x0000000002870000-memory.dmp
memory/616-142-0x0000000002870000-0x0000000002880000-memory.dmp
memory/616-141-0x00000000027C0000-0x00000000027D0000-memory.dmp
memory/616-145-0x0000000002880000-0x0000000002890000-memory.dmp
memory/616-125-0x0000000002820000-0x0000000002830000-memory.dmp
memory/616-148-0x0000000002890000-0x00000000028A0000-memory.dmp
memory/616-152-0x00000000028A0000-0x00000000028B0000-memory.dmp
memory/616-151-0x00000000027F0000-0x0000000002800000-memory.dmp
memory/616-147-0x00000000027E0000-0x00000000027F0000-memory.dmp
memory/616-156-0x00000000028B0000-0x00000000028C0000-memory.dmp
memory/616-155-0x0000000002820000-0x0000000002830000-memory.dmp
memory/616-154-0x0000000002810000-0x0000000002820000-memory.dmp
memory/616-153-0x0000000002800000-0x0000000002810000-memory.dmp
memory/616-158-0x00000000028C0000-0x00000000028D0000-memory.dmp
memory/616-161-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/616-160-0x0000000002830000-0x0000000002840000-memory.dmp
memory/616-164-0x00000000028E0000-0x00000000028F0000-memory.dmp
memory/616-163-0x0000000002840000-0x0000000002850000-memory.dmp
memory/616-168-0x0000000002850000-0x0000000002860000-memory.dmp
memory/616-171-0x0000000000610000-0x0000000000611000-memory.dmp
memory/616-175-0x0000000000610000-0x0000000000611000-memory.dmp
memory/616-176-0x0000000002860000-0x0000000002870000-memory.dmp
memory/616-126-0x0000000002770000-0x0000000002780000-memory.dmp
memory/616-177-0x0000000002870000-0x0000000002880000-memory.dmp
memory/616-186-0x0000000000610000-0x0000000000611000-memory.dmp
memory/616-187-0x00000000023C0000-0x0000000002630000-memory.dmp
memory/616-193-0x0000000002680000-0x0000000002690000-memory.dmp
memory/616-192-0x0000000002670000-0x0000000002680000-memory.dmp
memory/616-191-0x0000000002660000-0x0000000002670000-memory.dmp
memory/616-190-0x0000000002650000-0x0000000002660000-memory.dmp
memory/616-189-0x0000000002640000-0x0000000002650000-memory.dmp
memory/2852-0-0x000001FFD1C40000-0x000001FFD1C50000-memory.dmp
memory/2852-1-0x000001FFD45E0000-0x000001FFD4602000-memory.dmp
memory/2852-9-0x000001FFD1C40000-0x000001FFD1C50000-memory.dmp
memory/2852-10-0x000001FFD1C40000-0x000001FFD1C50000-memory.dmp
memory/2852-11-0x000001FFD1C40000-0x000001FFD1C50000-memory.dmp