1576f924c091b697b767344b7d518b63377e47d9ad4b7df9037160953c503676

Resubmissions

31/07/2026, 20:06

260731-yvs5wszepe

31/07/2026, 20:04

260731-ytmlqafh848

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
installs.bat
Size 4KB
Sample260731-ytmlqafh84
SHA256 1576f924c091b697b767344b7d518b63377e47d9ad4b7df9037160953c503676
MD5 9062c63653c95a695f6ae190c85b2cf2
SHA1 21dcdf7d8e59483f3cb3a9292191f1c0238322ab
SHA512 f50518e0161b17fc3e49d9615a20d72b39d1cdeff0ea30a9feb7996de481ea38b836d07c1f0c8f0a204dc49393de5405af250136b85b2a25660cde64b3a84a49
SSDEEP 96:Jk1TM0KNImTyK3+pmSypa25UekKnsjcJEIehqX7sFd+jnng3+MkX82LkIwR:Jk9MpImnU3feHJEh8gKnng3nkX8QkIwR
TLSH
T1D591840B37544375A77887268F2E15E1BB15829341412DF8BAEE06F81F443E0A9FB696
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2456	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2456	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	2456	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2716	cmd.exe
4976	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2456	powershell.exe
2456	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2456	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 3348	2716	cmd.exe	90
PID 2716 wrote to memory of 4976	2716	cmd.exe	91
PID 4976 wrote to memory of 4440	4976	cmd.exe	92
PID 2716 wrote to memory of 2456	2716	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\installs.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\system32\reg.exe
  reg query "HKU\S-1-5-19"
  2⤵
  PID:3348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c where python 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\system32\where.exe
    where python
    3⤵
    PID:4440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Invoke-WebRequest -Uri 'https://www.python.org/ftp/python/3.10.5/python-3.10.5-amd64.exe' -OutFile 'C:\Users\Admin\AppData\Local\Temp\extra\python-3.10.5-amd64.exe' -UseBasicParsing"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2456-0-0x00007FFF25B4F000-0x00007FFF25B50000-memory.dmp

Download

memory/2456-4-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2456-3-0x000001D7FBBB0000-0x000001D7FBBD2000-memory.dmp

Download

memory/2456-5-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2456-6-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2456-7-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2456-8-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2456-9-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2456-11-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2456-10-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2456-12-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2456-13-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2456-15-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download

memory/2456-16-0x00007FFF259C0000-0x00007FFF26364000-memory.dmp

Download