2f8354264820f29c194fffde73722d6ac73d17c75ed52e17e4de99eb50958992

Analysis

user interaction
yes
max time kernel
149s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uninstall_razer.bat
Size 559B
Sample260803-stmc3atzav
SHA256 2f8354264820f29c194fffde73722d6ac73d17c75ed52e17e4de99eb50958992
MD5 d578b540db8d2a0ba3a31033d455481b
SHA1 d5f30c84aebc789ce8b5371ffab228b8dd9919c6
SHA512 0aed23408b1e9b136ea46d044176d48acea7b215ccc66d3c400b2ca9e89d113b7ad0ff2ea58935bf0a61b730969dfe5c2b6a88f0475e90241963e04db7874ef9
TLSH
T1CAF09727ABEC87252D85DA4000B28610621A830A97328ECDBAF887482D4D769CB6A486
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3556	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5012	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3556	powershell.exe
3556	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3556	powershell.exe
Token: SeIncreaseQuotaPrivilege	3556	powershell.exe
Token: SeSecurityPrivilege	3556	powershell.exe
Token: SeTakeOwnershipPrivilege	3556	powershell.exe
Token: SeLoadDriverPrivilege	3556	powershell.exe
Token: SeSystemProfilePrivilege	3556	powershell.exe
Token: SeSystemtimePrivilege	3556	powershell.exe
Token: SeProfSingleProcessPrivilege	3556	powershell.exe
Token: SeIncBasePriorityPrivilege	3556	powershell.exe
Token: SeCreatePagefilePrivilege	3556	powershell.exe
Token: SeBackupPrivilege	3556	powershell.exe
Token: SeRestorePrivilege	3556	powershell.exe
Token: SeShutdownPrivilege	3556	powershell.exe
Token: SeDebugPrivilege	3556	powershell.exe
Token: SeSystemEnvironmentPrivilege	3556	powershell.exe
Token: SeRemoteShutdownPrivilege	3556	powershell.exe
Token: SeUndockPrivilege	3556	powershell.exe
Token: SeManageVolumePrivilege	3556	powershell.exe
Token: 33	3556	powershell.exe
Token: 34	3556	powershell.exe
Token: 35	3556	powershell.exe
Token: 36	3556	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 6040	5012	cmd.exe	90
PID 6040 wrote to memory of 3020	6040	net.exe	91
PID 5012 wrote to memory of 3556	5012	cmd.exe	92
PID 3556 wrote to memory of 5144	3556	powershell.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\uninstall_razer.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\uninstall_razer.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\system32\pnputil.exe
    "C:\Windows\system32\pnputil.exe" /enum-drivers
    3⤵
    PID:5144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3556-0-0x00007FFB1289F000-0x00007FFB128A0000-memory.dmp

Download

memory/3556-3-0x0000022FF10E0000-0x0000022FF1102000-memory.dmp

Download

memory/3556-4-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp

Download

memory/3556-5-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp

Download

memory/3556-6-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp

Download

memory/3556-7-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp

Download

memory/3556-8-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp

Download

memory/3556-11-0x0000022FF1360000-0x0000022FF137E000-memory.dmp

Download

memory/3556-12-0x0000022FF1380000-0x0000022FF1432000-memory.dmp

Download

memory/3556-13-0x0000022FF1140000-0x0000022FF114A000-memory.dmp

Download

memory/3556-14-0x0000022FF16B0000-0x0000022FF16CE000-memory.dmp

Download

memory/3556-15-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp

Download

memory/3556-16-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp

Download

memory/3556-17-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp

Download

memory/3556-18-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp

Download

memory/3556-19-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp

Download

memory/3556-21-0x00007FFB12710000-0x00007FFB130B4000-memory.dmp

Download