8b1f246458d50a0554e509ffac2bd295df2582a3f5aab99aa5fc45c0f1c42713

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
898s
max time network
572s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/08/2026, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UpdateTool.bat
Size 4KB
Sample260803-bt3avawblc
SHA256 8b1f246458d50a0554e509ffac2bd295df2582a3f5aab99aa5fc45c0f1c42713
MD5 271671a2b4300a04371c8a6ef03697db
SHA1 ae21c9b6f6b63102e6399e587159fe6bb9d6b086
SHA512 ceb75d3258cc47b589b5e9c51e021f2b0951afbb030d81ee98bc3ce7c85e7ce574cbce86dae986923281560e40abe9e5aeda6799141fd5fa74f44a87a4fb3a02
SSDEEP 48:Lr6QV8jNRcq99OrTgivKl0zeIwYS6x04Z0hJdV9dnOEm8N2UG0oIbB4nsfQw1:Lr675yq99LiiUjRxDaDdn1o0Z1
TLSH
T1A891887AAD08105E097BC06E04384899F84BD07A83651DC3363FA4F86F947ADF3EE1A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1052	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
648	powershell.exe
1004	powershell.exe
3908	powershell.exe
1052	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1028	cmd.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
648	powershell.exe
648	powershell.exe
1004	powershell.exe
1004	powershell.exe
1052	powershell.exe
1052	powershell.exe
3908	powershell.exe
3908	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	648	powershell.exe
Token: SeDebugPrivilege	1004	powershell.exe
Token: SeDebugPrivilege	1052	powershell.exe
Token: SeDebugPrivilege	3908	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 2012	1028	cmd.exe	81
PID 1028 wrote to memory of 648	1028	cmd.exe	82
PID 1028 wrote to memory of 1004	1028	cmd.exe	83
PID 1028 wrote to memory of 1052	1028	cmd.exe	84
PID 1028 wrote to memory of 3908	1028	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\UpdateTool.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\system32\where.exe
  where powershell
  2⤵
  PID:2012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Write-Host '[INFO] PowerShell detected.' -ForegroundColor Green"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Write-Host '[STEP 1/4] Downloading latest build...' -ForegroundColor Cyan"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$ProgressPreference='SilentlyContinue';" "try {" " Invoke-WebRequest -Uri 'https://nightly.link/Harry-Hopkinson/R6-No-Recoil/workflows/CI/main/R6NoRecoil.zip' -OutFile 'R6NoRecoil.zip' -UseBasicParsing;" " Write-Host 'Download completed successfully.' -ForegroundColor Green" "} catch { Write-Host 'Download failed:' $_.Exception.Message -ForegroundColor Red; exit 1 }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Write-Host '[ERROR] Failed to download ZIP file. Check your connection or URL.' -ForegroundColor Red"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1081c6b484e3ce0572ea539029bc598ee7870cf099c5585bd52fbeee220c56b7
MD5 8117d1162c008cf731fe668d81f95ac0
SHA1 1fdce919b160546d65f946726794b3331de06938
SHA512 711cc338d15b6b36cad3e8ca1a57b0595991f060d24f39faa2b24a2c4ca08c07c82497ed8b1bfbc998452778d75fb24558d72062ef5ee6848d99e35068c5f188
TLSH
T11B117A33B79CC135C8D9157A1089AD01B2B4C3C7049EDE8B7A84C509E57F58ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e1299c5457a20a3a0ddcee37c29fc652d4641f16291d33774267472759d2cbaf
MD5 ed6efad63134eaa4db3bf6e1a3287352
SHA1 43ff3e5127636e3c7491e9bbbbe8c49cce4ce96c
SHA512 95a42826918eadb94fcc28ff8610bcdb037c5eafdc095d9d14266fd64e2707e066a7f5539a863b50495ea6b0e78201d813f8fc1cf41788898cec406e76c1fdc8
TLSH
T196117A33B79CC135C8D9117A1089AD01B2B4C3C7049EDE8B7A84C509E57F58ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f18a24a5e061875cf83147e5651dff9eefefb9ada42adee866edb7e541fbc3df
MD5 cb3e00a3abf22fb6d453a9d1b24f296a
SHA1 2b23e6bbf1d0c519631baeb9c96adae8797d7b6a
SHA512 ca5f303f8b013300dc2b0e2b231dfb9f995930cc9d64ed5b2fd8fb9390a902e552a99868ec7db6bbe683c7da85667010a648a0a80154ae005122c4f2fe277604
TLSH
T18811BA33F39CC175C8D5117A1089AD01B2B1C3C7009EDECB7A84C408E57F58ADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bop1bt0k.cu3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bop1bt0k.cu3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/648-1-0x0000021BB22E0000-0x0000021BB22F0000-memory.dmp

Download

memory/648-0-0x0000021BB22E0000-0x0000021BB22F0000-memory.dmp

Download

memory/648-2-0x0000021BCDC90000-0x0000021BCDCB2000-memory.dmp

Download

memory/648-9-0x0000021BB22E0000-0x0000021BB22F0000-memory.dmp

Download

memory/1004-14-0x000001D255EA0000-0x000001D255EB0000-memory.dmp

Download

memory/1004-13-0x000001D255EA0000-0x000001D255EB0000-memory.dmp

Download

memory/1004-22-0x000001D255EA0000-0x000001D255EB0000-memory.dmp

Download