05ca42989badcbfb5d3296201bce5abbc9b23370bfb305ab367d60a509db4d25

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sleep method.bat
Size 792B
Sample260720-w7e3padt4t
SHA256 05ca42989badcbfb5d3296201bce5abbc9b23370bfb305ab367d60a509db4d25
MD5 8d7dec74c1791ce77cf0ec351a72c779
SHA1 d91bfd9bf735eb91138a27bc08f75c84215db271
SHA512 7d3d3e13d2ac3148d0a009d5196be417b7d83faeb788118382449fdcf4814c188baa410277afb604272bb221c6a7d0ce6d337473b771df34a4b41a0de4b3aa78
TLSH
T17801BD3123B2C72145E32A31CDD6D0E3EA131F10153E90487AEF979DEC5118ACABCA23
MD5 SHA1 SHA512 TLSH

Score

6^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
992	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4300	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
992	powershell.exe
992	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	992	powershell.exe
Token: SeSystemtimePrivilege	992	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 992	4300	cmd.exe	89
PID 992 wrote to memory of 4372	992	powershell.exe	90
PID 4372 wrote to memory of 4608	4372	csc.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\sleep method.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "try { [DateTime]$d = '1601-01-01'; $win32 = Add-Type -Name 'Kernel32' -Namespace 'Win32' -MemberDefinition '[DllImport(\"kernel32.dll\",SetLastError=true)] public static extern bool SetSystemTime(ref SystemTime st); [StructLayout(LayoutKind.Sequential)] public struct SystemTime { public ushort Year; public ushort Month; public ushort DayOfWeek; public ushort Day; public ushort Hour; public ushort Minute; public ushort Second; public ushort Milliseconds; }' -PassThru; $st = New-Object Win32.Kernel32+SystemTime; $st.Year = 1601; $st.Month = 1; $st.Day = 1; $st.Hour = 0; $st.Minute = 0; $st.Second = 0; [Win32.Kernel32]::SetSystemTime([ref]$st) } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hyemjsz1\hyemjsz1.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4372
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD6DE.tmp" "c:\Users\Admin\AppData\Local\Temp\hyemjsz1\CSC52863BF1CC7444FCB9CEFC21E11E7FA.TMP"
      4⤵
      PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESD6DE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESD6DE.tmp
Size 1KB
SHA256 67cc744f52cf12a3989cc531a887adc60ae83f3de70d96d5b0cdc561e7fb9565
MD5 2aec23025facdec9f47400c063e5627b
SHA1 3b83a136192f87ea43e18f27efaffbee9f468b62
SHA512 1c1bb378d70ca3f4eb59e951caaa844b22fa5c469b15e4c054882eac37a5440a935fff3c74e4c612e887bc07cfef48d168551e08a582e7f9acf6c4b3691815ed
TLSH
T10321AF0953ED470EF073573169F6172F9278FDA5EFA2935A8940422C1C41504EFE1B72
MD5 SHA1 SHA512 TLSH

Submit Download

hyemjsz1.dll

Path C:\Users\Admin\AppData\Local\Temp\hyemjsz1\hyemjsz1.dll
Size 3KB
SHA256 fafda12594844f5ae181201725134823f2ad62ed2546febb23f5d02f899a9a8b
MD5 0272801b3c8e1fe2684bd8f053cb2f9f
SHA1 38a87528b09c446020e162bc77d45d018783304a
SHA512 e792b812907a0e63b124fa01043c737704cd17c214323f2132601a5350054882413a605f5c91f63a0eeba55eb7ae45849c1d1c0f826dd9d17531ce57128451f3
TLSH
T1A571C017F3E8496BE4B78B396EF343162374FC109A76972E5D80532EAC642644D32BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC52863BF1CC7444FCB9CEFC21E11E7FA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\hyemjsz1\CSC52863BF1CC7444FCB9CEFC21E11E7FA.TMP
Size 652B
SHA256 08c207d29682b9364fc25ed456c73d4b0b2faad446e5319bd561084eebf4ab07
MD5 3fbd4754f71f11bfea8cf2bbac7c771c
SHA1 6d56142a2e5ed9c9b5b2102b5a434c4eb072be9d
SHA512 db1cf7e956144a738ffbda07563d6b477e8f8f98dafdaffd584c8a04a6d17ab2ec17f1f6f83bdb8faf14737e6e9541b998feea5ef83792d2ac37558eb2665305
TLSH
T191F05E4963FC020EF0F35F30BDF6436791A8BC64DE7293ED1440032928649148972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

hyemjsz1.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\hyemjsz1\hyemjsz1.0.cs
Size 470B
SHA256 98ff1485d003964fafa5c8a0cf9b7affdf362f5a6d8516660eb25f7d652856d8
MD5 b36928486fbbd92cef1e06401f66bcff
SHA1 4d002685d577ab669b3e4879ad6d9a0a993c6146
SHA512 cea8de136c8da8655870ae7863878cf9d95c23717c66a7e10007e1214fdedb9cd2eaed0b9c20aa3fe75530be4a4d2a7ac660cabc1b620d09b0bbad21bb26ae39
TLSH
T15BF0A03827F2DB3284E315258842D1D797234F22243F9805BBE94799CE86184D9BC626
MD5 SHA1 SHA512 TLSH

Submit Download

hyemjsz1.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\hyemjsz1\hyemjsz1.cmdline
Size 369B
SHA256 0d73528ff2eb737c9ec7210b0be31c8bd6d30361b234313615f76c9dcb02d070
MD5 f969294ba65e51f6b1c1048c43d34648
SHA1 8199896f2bac4245cf6aedf065327181d8993207
SHA512 ac6cd343d39fb79c9a9e6de9affbcefeb2317fbd059dea74b17a4b7dbbd8a53aa736d16a9afdf7c67fd64d18cde93d9beb7c69d0c21df4a2685db19d53cac999
TLSH
T1FBE0C03E5246CB7D11DD30073669C4ACD2F64B5379417F845649C80DD11F00837D1751
MD5 SHA1 SHA512 TLSH