ae04e36d5e332c5114c68d16289582b7be810dcd21eadaea3402362804a8a997

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Wvnuznhi.bat
Size 269KB
Sample260718-whnnjacv4x
SHA256 ae04e36d5e332c5114c68d16289582b7be810dcd21eadaea3402362804a8a997
MD5 83156b06a07efab818d32268d2fa0b44
SHA1 bd2082a8b4ef973cc07211a14eed8ee51eb52dbe
SHA512 b7edf58831f10bef6ba8efcbd65fbf5f035500b6d25ef3209ff4231e960c0a213e8864760fa9e920e4c8203dc8365c47c1ad4f71bc5167271d40f8e81fdfa1d0
SSDEEP 6144:MpSyC3zw0RAp7op8VQhUwapUJfOaAltOc2vH81tv:MpSnvwG/UJpiATOzvc7v
TLSH
T1EC4412AB5C076D248F7BC138F67F93A5723A9D6DC8E434DF857A8DB5482C3A12208179
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	1988	powershell.exe

Loads dropped DLL 2 IoCs

pid	Process
1988	powershell.exe
1988	powershell.exe

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
5032	certutil.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
4064	wscript.exe
548	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1988	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4528	cmd.exe
4120	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1988	powershell.exe
1988	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 4064	4120	cmd.exe	89
PID 4064 wrote to memory of 4528	4064	wscript.exe	91
PID 4528 wrote to memory of 5536	4528	cmd.exe	93
PID 5536 wrote to memory of 2568	5536	net.exe	94
PID 4528 wrote to memory of 5032	4528	cmd.exe	95
PID 4528 wrote to memory of 548	4528	cmd.exe	96
PID 548 wrote to memory of 1988	548	wscript.exe	97
PID 1988 wrote to memory of 3436	1988	powershell.exe	99
PID 3436 wrote to memory of 1972	3436	csc.exe	100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Wvnuznhi.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\system32\wscript.exe
  wscript //B C:\Users\Admin\AppData\Local\Temp\fZGh.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\Wvnuznhi.bat" _bZc_
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5536
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:2568
  - - C:\Windows\system32\certutil.exe
      certutil -decode C:\Users\Admin\AppData\Local\Temp\EVfcAFqI.b64 C:\Users\Admin\AppData\Local\Temp\fFHCKwvw.ps1
      4⤵
      Deobfuscate/Decode Files or Information
      PID:5032
  - - C:\Windows\system32\wscript.exe
      wscript //B C:\Users\Admin\AppData\Local\Temp\SYQE.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      Suspicious use of WriteProcessMemory
      PID:548
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\fFHCKwvw.ps1" "C:\Users\Admin\AppData\Local\Temp\Wvnuznhi.bat" _bZc_
        5⤵
        Badlisted process makes network request
        Loads dropped DLL
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1988
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zerfzlsh\zerfzlsh.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3436
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES51CF.tmp" "c:\Users\Admin\AppData\Local\Temp\zerfzlsh\CSC1CC484D2A41045249A7D2F932E3CDD6F.TMP"
        7⤵
        
        PID:1972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EVfcAFqI.b64

Path C:\Users\Admin\AppData\Local\Temp\EVfcAFqI.b64
Size 5KB
SHA256 03025c66df4b65089cf93830cb9ca197dfcc6a2ba97b029b3d09868b4fc57e99
MD5 ae151e19509d1dce5ad409c6cd7f416b
SHA1 2b855461a6dfa89516c8f1631cf22e7e6854e346
SHA512 22b97950900c64036f89bcce30a2ca76f495ea896d015b9de4dfa7f13387055d4b29efc5e02ebdad8658f4bfc52145daaef0f1df5c1c6c6fda61cc762715c99c
SSDEEP 96:2HcNXYuAW1RQmNs+YBEHaTUDkvvwujccVyaKqdGVeTSwngWvMq:+o1mm2+YBwaTzgujbNeeT5gsV
TLSH
T1CCC1E756ED261C5C4BEC625390CDA9E62B5F2FEB68F11ADE030E6F445A3D83810F01AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EVfcAFqI.b64

Path C:\Users\Admin\AppData\Local\Temp\EVfcAFqI.b64
Size 4KB
SHA256 46a14579dbad3ff2d3e966201f36a5e30f391bb7d319c02ae7bf68d19d835657
MD5 5c34b6868c0fb9c27c25b922cd7fc943
SHA1 37ce99c7160f068b5f937335e463096ea12e88a1
SHA512 f240cf1d483f6713daba6875807e7fe92340a06f17244d0a1925d07538a7787cfab98a20b98acbae8cab16b102e1f5133c85cfbed7e570660616a648c2db89d1
SSDEEP 96:2HcNXYuAW1RQmNs+YBEHaTUDkvvwujccVyaKe:+o1mm2+YBwaTzgujbx
TLSH
T17D91A657FE5A0CAC07C8A15350CCADE62E9E6BEB78F115EE461E6F445A3D83800F01AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES51CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES51CF.tmp
Size 1KB
SHA256 77d7c697d93b787b45dc37eac284f7aee3644fe6038d2087c57fa30031ce66a3
MD5 c4ae07dab48626d9c63b3336eb854440
SHA1 5dd8694550269f6288c88d95b79cb1522f3366c4
SHA512 a9343d1fc67c9f5b2c9f119ad79a6f1276b7b2099ebc7f8eaaa9a5329af3dc34232c8ddd30dd70880b3e6ce58b922f4a19aa0f1d3d5ff47f88178a7be33d9773
TLSH
T14421890593E8471EF073573169F6472FA238FDA4EFA2535B9640426C2C91148EEB1F72
MD5 SHA1 SHA512 TLSH

Submit Download

SYQE.vbs

Path C:\Users\Admin\AppData\Local\Temp\SYQE.vbs
Size 266B
SHA256 1d14b6441c36392fa15409caab3fa69729518bf7a1eae11eeb5da2bf80ff7815
MD5 eeb0bc0a54d99db118ca37406e14ca62
SHA1 6bcc43d7ef638bff566c1e17f8d0fe9d8ffdaf1e
SHA512 48b0bf1c2b35111aa47f6c0762f2ac0fb3fa9343a278cc6f40ba615b4be7f8c3f27d9ab29b6bc2b21fee176ca8b8c0590c5fa6e88fc3f0bd42533c56612473c5
TLSH
T172D02B14D36DC31D5D16D47F0576D56CC2B5048C37007B115A10860C748766ADAA624A
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp54CE.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp54CE.tmp
Size 2KB
SHA256 41a6391b731af0c2a14be8d5c999f4d8c98e612971595d043efd5a735efb6995
MD5 e179fbbbcb3676a629ab97b69a10925a
SHA1 5ce25d88e2cc523863a9f66c67027594da96dbf8
SHA512 f8db08862e100e77cdcf6ff967b22b7199a1527cc938314d6ea7c3ab6551cf484de5c5a53af803261fba18a672c52a9723e65ec4c8cc887de9e0e6aaddf1025b
TLSH
T147411BF711DB02B278ECECDDA2B50E379E545381BEE9427FF6B210AE1B499739054100
MD5 SHA1 SHA512 TLSH

Submit Download

fFHCKwvw.ps1

Path C:\Users\Admin\AppData\Local\Temp\fFHCKwvw.ps1
Size 4KB
SHA256 f3491afaaced6a47301314756b5325814356a8c00d5f6633c197ce7cea32482b
MD5 5d757c2a87792245da79df8c27167ae1
SHA1 7c01021c51c9c0430cb5f10a3a6e1358322103b8
SHA512 52cddc15643e465db91b8176a85fd253093be96ee40fc556d1ea394d16b329d440cf2c765e599d2f5119307a2dbf6b527479a7693c6c4f80219bf7831b6ae019
SSDEEP 96:AotspHlG9uSAjfQF7z0ujgx2LEqKlmsv1qeM72BSDjBuP3t2qP3qJi77C:QpH5jfQF7tjgx2oFARqk1uMq7C
TLSH
T1619164783624EA5884FA241D47BEC119E61A2022575A9E40F9CECB909FBE42DC3B1B49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fZGh.vbs

Path C:\Users\Admin\AppData\Local\Temp\fZGh.vbs
Size 125B
SHA256 4ccf4be269b7d7ea72e3be97cf2d963b62acd7627b6cdcafd2ede0ce84f3edb9
MD5 e75f7010220372773e56a78da36139e0
SHA1 a389386500489beae8e95aed2037322911c95009
SHA512 68811ac934faf8536d8755b4c1fdfb0ef42edeb58fb3ebb5ae6fbafabd8fa791f148e4df5451eec04e85fde70582190e0f965f80251dbb5d6ff16d37d3dea042
TLSH
T1B8B09B15D14DF52D0506D0F70535C54C85F4D88C275077124D14D44C65679D55555547
MD5 SHA1 SHA512 TLSH

Submit Download

tmp5375.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5375.tmp
Size 199KB
SHA256 717e383d40c3b581d67fe4d3530e7e5ec2ad3833e6ab6cadb82ca0327dba4878
MD5 3f812b823d4bf5516ca5aa258605fb1b
SHA1 9565f4fe8f0ffefee23e32cc8595382a06674052
SHA512 a5b8e520c2f34fc43263d82cba6ebd060c65857fbaaf0cf51c02d07f3e9f47557c406d8fbdabc5194ef837b7d4101b091c42849bbe4be1bf1ab5c7bd5d6292b7
SSDEEP 3072:NG8RHS1UJ6B3roJbPZYNM3MyYQtzkb39l2KOZKnyXv+/QRuixCihTpA55N88KgYB:NrE1NNMEQ4s7ZKyXv+/QRuixIST
TLSH
T1A41413402BEDFABECA70E23960F110F93674A2D25811F1B685CDDE7C5E8228057F7999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zerfzlsh.dll

Path C:\Users\Admin\AppData\Local\Temp\zerfzlsh\zerfzlsh.dll
Size 5KB
SHA256 386d72a1899e8b7d80558cde55a4301ccf8e7603945a38c8791d03a6078993f3
MD5 ac80120200f4f5d602f676ddf2a4ad88
SHA1 bbe3de644bdc5f9be6c1c0c85dad208616af4393
SHA512 1adf869f0009171f03b846417021ae0db4730c61eda3b4bde25b764265f8d2f1792fca4171d0e1b9891725d62da46060736b3ae387777d662d3ea478c162c1f2
SSDEEP 48:6QSGlqzc1e+ams6l1shOrIC6Ap2aBQdb1JLZUAYok3Ol6l8FAIt71ulaa3uq:kGl51k6l6cz6Ap2a+BO3Ol6lXIOMK
TLSH
T12EB1960B93E84A62E8BF4B3558F303162278EC155AB3676F108521697CA13A85E36BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC1CC484D2A41045249A7D2F932E3CDD6F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zerfzlsh\CSC1CC484D2A41045249A7D2F932E3CDD6F.TMP
Size 652B
SHA256 5d75be72ad6ad26836b46681ce44806e156742ed8edf63e8438603035278dd90
MD5 3075c42b53ea92f75d0e2eb63971d1cb
SHA1 c7ca503540aef12e13fcda891f32a007af1c3ba2
SHA512 0b3ecbf4d7be2f815cf47e51b34026febbf6ef6a84b272a0b5cd3011a73c94530e848e2af7a927ed1fe3a913f8863cc3fd0bf79e7295cd90e278da228429c5fc
TLSH
T156F05E0963F8421EF0F34B30BEF6836391A9BC64DE3293EE1540035928B45108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

zerfzlsh.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zerfzlsh\zerfzlsh.0.cs
Size 2KB
SHA256 21c6e47a171d97cf3128e9cd4a37fd7b7782d11be3cbc01617247b767d2757b3
MD5 48c8dd28daa707bb498f1c980404f957
SHA1 939639feb0536d397ab82f1e749da154f79ab4b6
SHA512 aeaf852672a99e92d91745d2d28db5c0faba3759b99afddfb9b6776b7c780951b69cd8a1828b32fd119c384656c823c192ee89bcbd45df209c9fd9b0cae37e34
TLSH
T10551E4A86718991998B6641D87D9C22DF24B74334BEE6B00F95F46E05FFA01DC271F18
MD5 SHA1 SHA512 TLSH

Submit Download

zerfzlsh.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zerfzlsh\zerfzlsh.cmdline
Size 369B
SHA256 cc449b489473506387fa457fbde2a89cab70f3ccc34b2db7b637dd70a88acc55
MD5 3e4adae73805b295ebdaa2cb93734134
SHA1 caf769d79589706906df78db15c689bec2beb17e
SHA512 7f6237b50849e1fc0c15417b86d36b680e69d9052c7d7fdc0acb093b6eba4b3aa84dae2863d012b2371ca7718b436becf1261a64c27440e1473fe2755461d2f8
TLSH
T1C1E0683A4246CABD29D910073179D4BDC277068729413F8C5060440DD11B20427E3741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1988-110-0x0000000005E60000-0x0000000005EC6000-memory.dmp

Download

memory/1988-107-0x0000000005730000-0x0000000005D7A000-memory.dmp

Download

memory/1988-118-0x0000000006AF0000-0x0000000006B0A000-memory.dmp

Download

memory/1988-115-0x00000000065B0000-0x00000000065FC000-memory.dmp

Download

memory/1988-114-0x0000000006590000-0x00000000065AE000-memory.dmp

Download

memory/1988-113-0x0000000006090000-0x00000000063EB000-memory.dmp

Download

memory/1988-109-0x0000000005DF0000-0x0000000005E56000-memory.dmp

Download

memory/1988-108-0x00000000056A0000-0x00000000056C2000-memory.dmp

Download

memory/1988-131-0x0000000006B40000-0x0000000006B48000-memory.dmp

Download

memory/1988-117-0x0000000007F00000-0x000000000857C000-memory.dmp

Download

memory/1988-136-0x00000000075D0000-0x0000000007608000-memory.dmp

Download

memory/1988-142-0x0000000007610000-0x0000000007664000-memory.dmp

Download

memory/1988-143-0x0000000007560000-0x0000000007578000-memory.dmp

Download

memory/1988-144-0x0000000007880000-0x00000000078CC000-memory.dmp

Download

memory/1988-106-0x0000000005090000-0x00000000050C6000-memory.dmp

Download

memory/1988-155-0x0000000007C30000-0x0000000007CC2000-memory.dmp

Download

memory/1988-156-0x0000000008B40000-0x00000000090FA000-memory.dmp

Download