6c469190922ed04804ba7561a8f61b90448432098b756eb2e4d31e884f81399d

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
windows.bat
Size 3KB
Sample260722-phb66shm2w
SHA256 6c469190922ed04804ba7561a8f61b90448432098b756eb2e4d31e884f81399d
MD5 a5616ae3c253f0d93f66085969499efa
SHA1 9c016a65ac1337488bb55e76c15e3bf21fb65a25
SHA512 51df3d55cb30e0c511d09c71bce054370c71e27d4a473428347151cc38e22b4ba35b562bbe5de8a763b2bd67eff61d6f85d850f272c1e15da16b3a96acd43bc4
TLSH
T16A7164062D991273299EC97EAC4450C2F34786AF0E8C6DE5346CE4993F1C8D14EFD2D6
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	3372	powershell.exe
11	3372	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4920	powershell.exe
3372	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5364	cmd.exe
336	cmd.exe
3056	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4920	powershell.exe
4920	powershell.exe
3372	powershell.exe
3372	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	powershell.exe
Token: SeDebugPrivilege	3372	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5364 wrote to memory of 4920	5364	cmd.exe	89
PID 4920 wrote to memory of 336	4920	powershell.exe	90
PID 336 wrote to memory of 3056	336	cmd.exe	92
PID 3056 wrote to memory of 3372	3056	cmd.exe	93
PID 336 wrote to memory of 4888	336	cmd.exe	96
PID 336 wrote to memory of 6136	336	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process -FilePath cmd.exe -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\windows.bat\" _restarted' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\windows.bat" _restarted
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "(Invoke-RestMethod https://nodejs.org/dist/index.json)[0].version"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3056
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "(Invoke-RestMethod https://nodejs.org/dist/index.json)[0].version"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3372
  - - C:\Windows\system32\where.exe
      where curl
      4⤵
      PID:4888
  - - C:\Windows\system32\curl.exe
      curl -s -L -o "C:\Users\Admin\AppData\Local\Temp\node-v26.5.0-x64.msi" "https://nodejs.org/dist/v26.5.0/node-v26.5.0-x64.msi"
      4⤵
      PID:6136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5b7d8748f44888ed37c7eaab85ad664b786caa2ed0acecfaaee759d0cefea041
MD5 d998bc543cb537ea8b43c410b312a6ab
SHA1 98c73bc27859bcc813450a87da88febea5e12fe9
SHA512 ec50090d17b9b6414186ee3b2e8bd65936fcd437c12e82d2b3b57110999d372bcc5bfcdcdf1dae290ba609f5d4d5b7ba41921c10d28d1aa79bb153c550fab20d
TLSH
T136115733B3CC8624CC9A403650CEAC1036B687DB509ECE6BBB84D144B43F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3372-18-0x0000020FB2490000-0x0000020FB29B8000-memory.dmp

Download

memory/3372-17-0x0000020FB1D90000-0x0000020FB1F52000-memory.dmp

Download

memory/4920-5-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/4920-6-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/4920-7-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/4920-8-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/4920-10-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/4920-11-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/4920-0-0x00007FFE601FF000-0x00007FFE60200000-memory.dmp

Download

memory/4920-15-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/4920-4-0x00007FFE60070000-0x00007FFE60A14000-memory.dmp

Download

memory/4920-3-0x000001A79BA60000-0x000001A79BA82000-memory.dmp

Download