a27c55cfa2f81aa2cca467b6deb8c9c45e25ce205b68df15dc91a9c3a77d56ef

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a27c55cfa2f81aa2cca467b6deb8c9c45e25ce205b68df15dc91a9c3a77d56ef.exe
Size 22KB
Sample260731-ecqghacb76
SHA256 a27c55cfa2f81aa2cca467b6deb8c9c45e25ce205b68df15dc91a9c3a77d56ef
MD5 4d228640148ba9f5d6209347f8f981ef
SHA1 23f6bf50710972b93d0a94d22999b314324253df
SHA512 de8bcc44fe6f349dea70d284b4c368690f3da10dfb5a1731a0fa35df0659289a8dd12e7ecea2c86a65785ec8d7dc9ae4d3d341c3b73e83b11c1f243735cd0610
SSDEEP 384:kBtEcbJOb+8UzJus+RShy3w8PlLJ4jz19:iWeObBU5hyg2szX
TLSH
T187A2180A1A8619FEFD46C23DD0208976AAA2BD211B21C1FF17B356362D55FE0DE3D5C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2788	svcmsvc05C1r.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1104	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1480	cmd.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5256	a27c55cfa2f81aa2cca467b6deb8c9c45e25ce205b68df15dc91a9c3a77d56ef.exe
5256	a27c55cfa2f81aa2cca467b6deb8c9c45e25ce205b68df15dc91a9c3a77d56ef.exe
1104	powershell.exe
1104	powershell.exe
1104	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeIncreaseQuotaPrivilege	1104	powershell.exe
Token: SeSecurityPrivilege	1104	powershell.exe
Token: SeTakeOwnershipPrivilege	1104	powershell.exe
Token: SeLoadDriverPrivilege	1104	powershell.exe
Token: SeSystemProfilePrivilege	1104	powershell.exe
Token: SeSystemtimePrivilege	1104	powershell.exe
Token: SeProfSingleProcessPrivilege	1104	powershell.exe
Token: SeIncBasePriorityPrivilege	1104	powershell.exe
Token: SeCreatePagefilePrivilege	1104	powershell.exe
Token: SeBackupPrivilege	1104	powershell.exe
Token: SeRestorePrivilege	1104	powershell.exe
Token: SeShutdownPrivilege	1104	powershell.exe
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeSystemEnvironmentPrivilege	1104	powershell.exe
Token: SeRemoteShutdownPrivilege	1104	powershell.exe
Token: SeUndockPrivilege	1104	powershell.exe
Token: SeManageVolumePrivilege	1104	powershell.exe
Token: 33	1104	powershell.exe
Token: 34	1104	powershell.exe
Token: 35	1104	powershell.exe
Token: 36	1104	powershell.exe
Token: SeIncreaseQuotaPrivilege	1104	powershell.exe
Token: SeSecurityPrivilege	1104	powershell.exe
Token: SeTakeOwnershipPrivilege	1104	powershell.exe
Token: SeLoadDriverPrivilege	1104	powershell.exe
Token: SeSystemProfilePrivilege	1104	powershell.exe
Token: SeSystemtimePrivilege	1104	powershell.exe
Token: SeProfSingleProcessPrivilege	1104	powershell.exe
Token: SeIncBasePriorityPrivilege	1104	powershell.exe
Token: SeCreatePagefilePrivilege	1104	powershell.exe
Token: SeBackupPrivilege	1104	powershell.exe
Token: SeRestorePrivilege	1104	powershell.exe
Token: SeShutdownPrivilege	1104	powershell.exe
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeSystemEnvironmentPrivilege	1104	powershell.exe
Token: SeRemoteShutdownPrivilege	1104	powershell.exe
Token: SeUndockPrivilege	1104	powershell.exe
Token: SeManageVolumePrivilege	1104	powershell.exe
Token: 33	1104	powershell.exe
Token: 34	1104	powershell.exe
Token: 35	1104	powershell.exe
Token: 36	1104	powershell.exe
Token: SeIncreaseQuotaPrivilege	1104	powershell.exe
Token: SeSecurityPrivilege	1104	powershell.exe
Token: SeTakeOwnershipPrivilege	1104	powershell.exe
Token: SeLoadDriverPrivilege	1104	powershell.exe
Token: SeSystemProfilePrivilege	1104	powershell.exe
Token: SeSystemtimePrivilege	1104	powershell.exe
Token: SeProfSingleProcessPrivilege	1104	powershell.exe
Token: SeIncBasePriorityPrivilege	1104	powershell.exe
Token: SeCreatePagefilePrivilege	1104	powershell.exe
Token: SeBackupPrivilege	1104	powershell.exe
Token: SeRestorePrivilege	1104	powershell.exe
Token: SeShutdownPrivilege	1104	powershell.exe
Token: SeDebugPrivilege	1104	powershell.exe
Token: SeSystemEnvironmentPrivilege	1104	powershell.exe
Token: SeRemoteShutdownPrivilege	1104	powershell.exe
Token: SeUndockPrivilege	1104	powershell.exe
Token: SeManageVolumePrivilege	1104	powershell.exe
Token: 33	1104	powershell.exe
Token: 34	1104	powershell.exe
Token: 35	1104	powershell.exe
Token: 36	1104	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5256 wrote to memory of 1480	5256	a27c55cfa2f81aa2cca467b6deb8c9c45e25ce205b68df15dc91a9c3a77d56ef.exe	89
PID 1480 wrote to memory of 1104	1480	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\a27c55cfa2f81aa2cca467b6deb8c9c45e25ce205b68df15dc91a9c3a77d56ef.exe
"C:\Users\Admin\AppData\Local\Temp\a27c55cfa2f81aa2cca467b6deb8c9c45e25ce205b68df15dc91a9c3a77d56ef.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\h05C1.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\w.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1104

C:\Users\Admin\AppData\Local\WinCfg\svcmsvc05C1r.exe
"C:\Users\Admin\AppData\Local\WinCfg\svcmsvc05C1r.exe"
1⤵
- Executes dropped EXE
PID:2788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

h05C1.bat

Path C:\Users\Admin\AppData\Local\Temp\h05C1.bat
Size 693B
SHA256 71fd9ed01f613f601d03d8530c26782dadc65f411bcff025d19165d3d8f8be57
MD5 03c816e740e68038f12ad901e28439dd
SHA1 e882ca6a555a628994930b282db1f80ed87e90ee
SHA512 ab4ce444cf5108753f99a599f08a9099b2784618256d1f2dd897f503be229d1157b6e71726ac0fda12e680f0b2f9adbb5dab2a768d03729e327f3662544852d2
TLSH
T14D017B3BD2046A31DC8E1C68E9515C5258665C2CE97B2EBCD51B002FD293A76C3EBD8D
MD5 SHA1 SHA512 TLSH

Submit Download

w.ps1

Path C:\Users\Admin\AppData\Local\Temp\w.ps1
Size 413B
SHA256 a3ae3ded0fcfb6d50696de59cb5319574c50e7d62623293ccbe3b8a31bd765e6
MD5 42d2fc6c5f8f8ad93458c5dedbf674d3
SHA1 36333422f9214caa1a0fef6099e5b92511fd816c
SHA512 e8ada44301fedd805662a31af30158841943821d3e89794171b4e2027fee15d92a6b757e4ef2478acaa271a6d74ecc410318663d033fcb67472e70881659bb63
TLSH
T1C3E09B36DA64D135CCCA2C6AD8A1B5945C195C1DEDB7361C561F5038E2A742BD38D80D
MD5 SHA1 SHA512 TLSH

Submit Download

svcmsvc05C1r.exe

Path C:\Users\Admin\AppData\Local\WinCfg\svcmsvc05C1r.exe
Size 22KB
SHA256 a27c55cfa2f81aa2cca467b6deb8c9c45e25ce205b68df15dc91a9c3a77d56ef
MD5 4d228640148ba9f5d6209347f8f981ef
SHA1 23f6bf50710972b93d0a94d22999b314324253df
SHA512 de8bcc44fe6f349dea70d284b4c368690f3da10dfb5a1731a0fa35df0659289a8dd12e7ecea2c86a65785ec8d7dc9ae4d3d341c3b73e83b11c1f243735cd0610
SSDEEP 384:kBtEcbJOb+8UzJus+RShy3w8PlLJ4jz19:iWeObBU5hyg2szX
TLSH
T187A2180A1A8619FEFD46C23DD0208976AAA2BD211B21C1FF17B356362D55FE0DE3D5C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1104-27-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/1104-34-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/1104-14-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/1104-15-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/1104-16-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/1104-12-0x0000021F10CB0000-0x0000021F10CD2000-memory.dmp

Download

memory/1104-20-0x0000021F29380000-0x0000021F2939E000-memory.dmp

Download

memory/1104-21-0x0000021F293A0000-0x0000021F29452000-memory.dmp

Download

memory/1104-22-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/1104-23-0x0000021F29460000-0x0000021F2946A000-memory.dmp

Download

memory/1104-24-0x0000021F29490000-0x0000021F294AE000-memory.dmp

Download

memory/1104-25-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/1104-26-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/1104-9-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/1104-13-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/1104-30-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/1104-28-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/1104-31-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/1104-32-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/1104-29-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/1104-33-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/1104-35-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/1104-37-0x00007FF902660000-0x00007FF903004000-memory.dmp

Download

memory/1104-8-0x00007FF9027EF000-0x00007FF9027F0000-memory.dmp

Download

memory/5256-39-0x000001DA1A520000-0x000001DA1A6F9000-memory.dmp

Download

memory/5256-47-0x000001DA1A520000-0x000001DA1A6F9000-memory.dmp

Download

memory/5256-46-0x000001DA1A520000-0x000001DA1A6F9000-memory.dmp

Download

memory/5256-45-0x000001DA1A520000-0x000001DA1A6F9000-memory.dmp

Download

memory/5256-48-0x000001DA1A520000-0x000001DA1A6F9000-memory.dmp

Download