a79af4c702d0ab607cdc438bf9af01203f20a258a4d58948f7ee8dc43153a008

Analysis

max time kernel
300s
max time network
303s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IRS NOTICE 2025.bat
Size 2.6MB
Sample260804-ve652aszet
SHA256 a79af4c702d0ab607cdc438bf9af01203f20a258a4d58948f7ee8dc43153a008
MD5 36d4f4a10afc5ae9e5de0ac818ce86d9
SHA1 e9b2bec4622cc09382e3cd314ac084e2b3301a06
SHA512 ecd57f2ce1faa4b6ff23f29240680700800d777921bf1b87ec3b4207a4d59da302009f7cabd31bbc7ee5b6a561d38221c4555fc37498bfb4161c5cd14227b2c2
SSDEEP 24576:6LnkYATkxrOLnkYATkxrLuFnRhi+3cVoaP/DKOPjL0x9wUVyZE15F:3swUIZE15F
TLSH
T12CC585A665907D30230EE377AA8AD4A4377232EAB5140F987F56D9CB31F80B750CC6E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
281	raw.githubusercontent.com
282	raw.githubusercontent.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4928	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1672	cmd.exe
6052	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5988	PING.EXE
5008	PING.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5988	PING.EXE
5008	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5204	MSBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 4816	1672	cmd.exe	90
PID 1672 wrote to memory of 4928	1672	cmd.exe	91
PID 4928 wrote to memory of 6052	4928	wscript.exe	92
PID 1672 wrote to memory of 5988	1672	cmd.exe	94
PID 6052 wrote to memory of 4704	6052	cmd.exe	95
PID 6052 wrote to memory of 5204	6052	cmd.exe	96
PID 1672 wrote to memory of 5008	1672	cmd.exe	97
PID 5204 wrote to memory of 5216	5204	MSBuild.exe	98
PID 5216 wrote to memory of 3216	5216	csc.exe	99
PID 5204 wrote to memory of 5020	5204	MSBuild.exe	100
PID 5020 wrote to memory of 256	5020	csc.exe	101

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\IRS NOTICE 2025.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4816
- C:\Windows\system32\wscript.exe
  wscript //B //E:vbscript "C:\Users\Admin\AppData\Local\Temp\2353111957.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\IRS NOTICE 2025.bat" /launched
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6052
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4704
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\IRS NOTICE 2025.bat"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5204
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5vksfh0d\5vksfh0d.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5216
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES40D8.tmp" "c:\Users\Admin\AppData\Local\Temp\5vksfh0d\CSCB4683A28271641B586686E53F7A691DC.TMP"
        6⤵
        
        PID:3216
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zk5rrj00\zk5rrj00.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5020
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES41A3.tmp" "c:\Users\Admin\AppData\Local\Temp\zk5rrj00\CSC788BC636AE324E76AF75BFEC64E7D34E.TMP"
        6⤵
        
        PID:256
- C:\Windows\system32\PING.EXE
  ping -n 3 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5988
- C:\Windows\system32\PING.EXE
  ping -n 2 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2353111957.vbs

Path C:\Users\Admin\AppData\Local\Temp\2353111957.vbs
Size 122B
SHA256 64f1bcac919f4abb781a4d5bceaecf93b4c4d54bf9ebd1a51111626ed00c754b
MD5 69b3436ad49a1752ba3bc69118fe0a8c
SHA1 ff17db2d6858c10b851238f4b84c9511b9fb8954
SHA512 85a567c3880b3498cf9bc268110ab9fc4d34b92caae08e5c3d03f2dd246540d81751bf035776061f832fc061c88bbdb9ec4aa9506ff829c9026358071c97740b
TLSH
T155B02202A808E02A002AA0AB0E30E20EC8A0CC882A282F000220880C222A8A8EA82002
MD5 SHA1 SHA512 TLSH

Submit Download

5vksfh0d.dll

Path C:\Users\Admin\AppData\Local\Temp\5vksfh0d\5vksfh0d.dll
Size 16KB
SHA256 b99a8881c879585961233df542b1c7020cc0006078f026cc8aee1aff4dd7e096
MD5 e8e5eeb61f618a2df4840198ad0e8f44
SHA1 4582d202cec4f24dea5707f87e56eb429489e09a
SHA512 0eb400e7e76ef37eda42cedf1cae036c614471fe6d2486e82f08968a70ae10e9a35573e0c3cb87f7bf325f361f6452f036efce5b9d6dd818a76e94a42b7df3bc
SSDEEP 384:/btETqIDoOLDMWkE2sN/jwWe93jqHg5v:ZoMfebwWe9eUv
TLSH
T18F72B50AB349A501C41B1B3AEDA917A7D02276CEBEF5D36E68449ED0ACF32B045447F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5vksfh0d.pdb

Path C:\Users\Admin\AppData\Local\Temp\5vksfh0d\5vksfh0d.pdb
Size 19KB
SHA256 b1b3682b0a86c36eedad126b4e685f1cc36170d0e2152e6cdaa5140c8b2d9f02
MD5 56f5fbbe73ad85d193d1d99cf1b25a39
SHA1 96382eb5d42142ce0ca63018f792b9bb8a4c8c5c
SHA512 ae5ece461a4cd0f45ea7d77fdc4eb34298ee417b81c19cce085922a8a8443dd4269e2b3b882fa9d149c016ece775d90c43e5ab4f4d8759d85d47dd5b70e03139
SSDEEP 192:fApTzH4/uAkIhzrpHht3Xj99cDMkME4+oOnUXOcxxh8ZiytH4:2TE/bRFrNhdXjbgjPZiytH
TLSH
T13692A885BB86CAF2C41ACA3C559B0F8C6138FC455F9B8B5B2B1CB92C7D722061DC52C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES40D8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES40D8.tmp
Size 1KB
SHA256 053fcf093777d357d4311c3c0f20896f7536795ca58e42d7e2caaa2431709023
MD5 9ab996a57e54d95ab4c08363990895e4
SHA1 701eab6b20915b88d0afa1f6923b59fc3882ba9e
SHA512 1670e020c4902c0978f8dbd45817cc91d2c946f40f90a48408549e1c3948a7cbfde349444eae58e0ad5a7ba28f04473342fae9a19d4f0e7428e1b55590e2678e
TLSH
T15321AF0543E8871EF0B34732AAFA472FA278FD58DFA2A35B8541022C2C11154EEF0B72
MD5 SHA1 SHA512 TLSH

Submit Download

RES41A3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES41A3.tmp
Size 1KB
SHA256 6b14bcfbebccce8049c282ec0d8fd51f907373514c1bfe82edcdab2b2fef7f8a
MD5 f07f439cb23b145e7cad82bc4a4c28d4
SHA1 e0a92d19b7539964e97cf78c237c5ba300cc0eb5
SHA512 18d756c27632259df05700dd4c7a3c08c806733a95bb26e79268973bf2429f1f8e850adcaad28046d2eb4b5f1965c8a01f7a04f018ba92f79e9e49a202a709d0
TLSH
T19721C90593E8471AF0734731A9F6872FD278FD69EFA2935A890443282811148EEE0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

zk5rrj00.dll

Path C:\Users\Admin\AppData\Local\Temp\zk5rrj00\zk5rrj00.dll
Size 5KB
SHA256 edd7a97f47ec9a49ba618c33d80e372579d0090afba1c92d11cdb57092614b15
MD5 518e9e21a9ca846d7ae7b2c8406a6651
SHA1 d9f978d1eabca434e3168c7cb3709223be42cad9
SHA512 408941a81e871f0359db4e77e0457770a92d4a2efebdc4a72928a0b9f23050990af32498d8e9bc65e9a76115746c70c240fb15e9793697a8dae5e648fb6f655d
SSDEEP 48:6DFDeOJDTUGVONnMcVUxAn/ThEpyvJyhhJqKKuK9R5gfB/MMJlDpBrSvm+QTw8va:SlJDT0Nu4/TS4vJyhC54TzFBY8AEK
TLSH
T1E6C1A55A7BE8862AE4FF47783EF34B066275AE55AE19855F2CC8011D0C31B205D21FB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5vksfh0d.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5vksfh0d\5vksfh0d.0.cs
Size 20KB
SHA256 bc65ff989fb0cbfba788d7968c9447fb1ab71ce5bdfe6ce47ec12a1c2b1bb384
MD5 7d8a99ffbfcd4f9a0a3c256185269a24
SHA1 259e796cd4b7073d41270838389863925ba7bf88
SHA512 b2a519c2b1be75d9ff796cc3e64d022d3f093b598c07465f9d93fb6e28f71fd13d399e204dc27133054bed6c29728d3b7bbeb9deba8ae4f7bf51b375fa1ece3b
SSDEEP 384:/0mvGeFXvXeoRgtVFzvDQfrnIvt1MWmJgK4ThQxeBFG/8W51fb9SA61mTckg:/LvG8vuhh76I1iWmQTFGxrfZSqZg
TLSH
T1C4A2EDE6BD8D96BFB39C131435CB1E4687B8A324C0ACE88A7765F9D0B19314124B5DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5vksfh0d.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5vksfh0d\5vksfh0d.cmdline
Size 1KB
SHA256 8e0579fd0d76c3d5eddb86a6cfb0e198f9c790585e951ae22bcb5422338b767f
MD5 c9c778b5f98769e56cf547656ecc754a
SHA1 1a85b59612395c3586b9c742c388f2dd4a3b35d6
SHA512 05b59f0faa6a0883d7b6eb80b920573444442155032778a73ae5572587904cfeaa2cebaf76eb1b4270918a0263cf3d161734475af70b2650dd9fef4856741c42
TLSH
T146218E24833781F7C6B27887186E1F1CF01B038F30C2EF186688481F66A39948C217B1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB4683A28271641B586686E53F7A691DC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\5vksfh0d\CSCB4683A28271641B586686E53F7A691DC.TMP
Size 652B
SHA256 ecfcc6e7e3350e291b48a72287abe42cd9111d7a1298afd80e697ba1a830bdcf
MD5 1a338a82cd43d652bc159fbfd2860a6c
SHA1 3ea3316615e93a7269852dbaccddcc328708b5a1
SHA512 9c79162d787e668b688763134942c5f96cc888ec201035e09edc7b7b635edc2236fae129c721396385f9a8e6adea1c4d9ba008c1a2cad06705993ae29b7aab3f
TLSH
T1E5F03A0963F8520AF0F34B70BAF6836391A9BC68DE7293ED1441035D2C64620C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC788BC636AE324E76AF75BFEC64E7D34E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zk5rrj00\CSC788BC636AE324E76AF75BFEC64E7D34E.TMP
Size 652B
SHA256 df17e82eeeb0ae3afbee228b4f9768a299f071e1f89dffce7897da6b863edd7e
MD5 d6b4f51cf114b0c16981a64b6645ea6a
SHA1 01a3cb3df134237ac46f2c4d21d1cd0c22c074db
SHA512 4c9f14d4ff4d7329319cd715b31ba7579221d946dfadf7589abd152fe3d9fb6df07a2155a0f03afec38485e34755eff3d2e9eb5db489da245d0c8f289631c51b
TLSH
T1D4F05E4963F8020EF4F74B30BDF6836391A8BC65DE3293ED6844031928745108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

zk5rrj00.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zk5rrj00\zk5rrj00.0.cs
Size 2KB
SHA256 eeb5a0f05c83145662b0b33f69596ed459772f9c53e3f29e10e4ba4bf921fac1
MD5 0a7c95f7ab1508bad36420dacf582c34
SHA1 acf67630104ba6effe522db001896cf36c037feb
SHA512 6a329dfe821382d61a490da973ee8cf391d1fad8aef0433d7a23b78da9e635aa885d00d74109a50c6ee28c0523474db52cffe765c1d5a8f7bca2324f5116f3e9
TLSH
T1F451B8693296D6684DC339C810E9D07262B1F235704CAD11B4C85949D79FD78D7F0F9A
MD5 SHA1 SHA512 TLSH

Submit Download

zk5rrj00.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zk5rrj00\zk5rrj00.cmdline
Size 204B
SHA256 5ff4c6f8a4220d24b2c5bdaf6655d10dc26854b7b183e4eca33e7fedd393511b
MD5 21941b0aebdd5ac10061ff11939997df
SHA1 a865d127e5ed1635e596beb7fc89d15c23815fed
SHA512 cc2a8e88f8443d6647b9e0116c0376b98ea25302ea7174d00293a8b3a9e97c43acf20169adaf88f9e5e2f6f77ca7852b3fa024d297c59bb73a6ddc822031ae75
TLSH
T140D0221A0287CB29A18AB347A0A0C0ECC2F30D0739083FC68174584D1223008B3DAF02
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5204-6-0x0000000005EE0000-0x0000000006002000-memory.dmp

Download

memory/5204-9-0x00000000064A0000-0x0000000006800000-memory.dmp

Download

memory/5204-8-0x00000000062C0000-0x000000000643C000-memory.dmp

Download

memory/5204-24-0x0000000005DC0000-0x0000000005DCA000-memory.dmp

Download

memory/5204-7-0x0000000005E00000-0x0000000005E44000-memory.dmp

Download

memory/5204-5-0x0000000005110000-0x0000000005140000-memory.dmp

Download

memory/5204-4-0x0000000005210000-0x000000000536A000-memory.dmp

Download

memory/5204-3-0x0000000005020000-0x000000000503A000-memory.dmp

Download

memory/5204-2-0x0000000000490000-0x00000000004D0000-memory.dmp

Download

memory/5204-37-0x0000000005DF0000-0x0000000005DF8000-memory.dmp

Download

memory/5204-38-0x0000000007280000-0x00000000073CA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads