5b910ac1d2c006f5160a2dada98351cf6d41ee347671479cdb35b3976bb25f2b

Analysis

user interaction
yes
max time kernel
52s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0_DELAY_ULTIMATE_TWEAKS (1) (1).bat
Size 171KB
Sample260809-bd13vagb55
SHA256 5b910ac1d2c006f5160a2dada98351cf6d41ee347671479cdb35b3976bb25f2b
MD5 5fdc439dc2cfdcbcd2b9ab397cd514df
SHA1 7c83c97dabce4a1871736910b1c9d674cac75a48
SHA512 b997288657b305289f2791b55ad723d3321b9535f6ebe53c1428ffdf83b2b1eb4fbdb9e72ec38fe4570f788e81652960bb55ba5e8c4c44f60924b92b94e71824
SSDEEP 1536:GF37BQIOkxxBSGOGL9SEgc3tIt3tbps3tTX8:S7BQ8xxBSG5LkEgc3tIt3tbps3tL8
TLSH
T19404E320963F02B3CA96F2207653D5265F7BBEC364C45B4178AE350A11EBC8BC8767E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion execution

Malware Config

Signatures

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2792	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5244	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3196	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2792	powershell.exe
2792	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5244 wrote to memory of 2792	5244	cmd.exe	82
PID 2792 wrote to memory of 1672	2792	powershell.exe	83
PID 5244 wrote to memory of 4428	5244	cmd.exe	84
PID 5244 wrote to memory of 3196	5244	cmd.exe	85

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1672	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\0_DELAY_ULTIMATE_TWEAKS (1) (1).bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "attrib +h \"C:\Program Files\Windows NT\Accessories\en-US\important_system_file.dll\""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +h "C:\Program Files\Windows NT\Accessories\en-US\important_system_file.dll"
    3⤵
    - Views/modifies file attributes
    PID:1672
- C:\Windows\system32\findstr.exe
  findstr /x "o" "C:\Program Files\Windows NT\Accessories\en-US\important_system_file.dll"
  2⤵
  PID:4428
- C:\Windows\system32\timeout.exe
  timeout /nobreak /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:3196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_rfslfxqj.2xu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rfslfxqj.2xu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH