9ce930149440feb8f03cdf4dfbe88c9f4a7edb13d0b83ee5d2f3875e2197a0e3

Analysis

user interaction
yes
max time kernel
126s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 21:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Lightburn.2.1.03.x64/Block Host.cmd
Size 1KB
Sample260811-z2mgcssarg
SHA256 9ce930149440feb8f03cdf4dfbe88c9f4a7edb13d0b83ee5d2f3875e2197a0e3
MD5 b53d4a73924f8ec6b8d06f9d75a55f29
SHA1 bddea3c2b7f90cbf2d74ca593b4bbb3655646da4
SHA512 f8191c8329ffa2b51a9c7405f4b3053f46c5a3704dd6342aedaff61e875bb60c0ec61bfeeefb0c12476be9e16981575fa7fdfc23e02d233b6ce150e180ef552a
TLSH
T18231982CFD20F47C41A6C2688C34A285F566B0BF4B121CC9741FD32047B32B4A3A6DB4
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	attrib.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3100	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2760	cmd.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1036	ipconfig.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3100	powershell.exe
3100	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3100	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 3832	2760	cmd.exe	89
PID 3832 wrote to memory of 4180	3832	net.exe	90
PID 2760 wrote to memory of 5992	2760	cmd.exe	91
PID 2760 wrote to memory of 1240	2760	cmd.exe	92
PID 2760 wrote to memory of 1568	2760	cmd.exe	93
PID 2760 wrote to memory of 2300	2760	cmd.exe	94
PID 2760 wrote to memory of 4120	2760	cmd.exe	95
PID 2760 wrote to memory of 976	2760	cmd.exe	96
PID 2760 wrote to memory of 1036	2760	cmd.exe	97
PID 2760 wrote to memory of 3100	2760	cmd.exe	98

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1240	attrib.exe
976	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Lightburn.2.1.03.x64\Block Host.cmd"
1⤵
- Drops file in Drivers directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4180
- C:\Windows\system32\mode.com
  mode con:cols=90 lines=30
  2⤵
  PID:5992
- C:\Windows\system32\attrib.exe
  attrib -r C:\Windows\system32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:1240
- C:\Windows\system32\findstr.exe
  findstr /i /c:"127.0.0.1 api.cryptlex.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:1568
- C:\Windows\system32\findstr.exe
  findstr /i /c:"127.0.0.1 raw.githubusercontent.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2300
- C:\Windows\system32\findstr.exe
  findstr /i /c:"127.0.0.1 lightburnsoftware.github.io" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:4120
- C:\Windows\system32\attrib.exe
  attrib +r C:\Windows\system32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:976
- C:\Windows\system32\ipconfig.exe
  IPCONFIG -flushdns
  2⤵
  - Gathers network information
  PID:1036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "function Show-Message($t,$f,$b){Write-Host $t -ForegroundColor $f -BackgroundColor $b}; Show-Message ' Successfully Host Block in Windows ' Black Green"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 f7ac3d3133ac06faa84c62379bf19384943325e94e0cadace6f8ee0c5feda05a
MD5 80189fa2d103a51d963ec2da1478caa8
SHA1 560cfa888077879fff3266c730ecfcccedd2b85c
SHA512 a1805153f978813d4d872c5affe0ed74bfd53d2925070b91232df7ab0449b013ddab9f82d4f191a6124f6450540726f93b00947ce02a2507bfb7009426d5d675
TLSH
T13D21DD2A0649915D26B341E5092CF82FA31FC0EF0E3B8DCD3E8E450F7BA2A0C5326746
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 905456d6fe9fb5f50e60431ef3256510158e0aee84bbdefa741d7a6624eb73bc
MD5 2d406d90212fec7183ded1d00912e654
SHA1 289860e4da5d710611fadc01fd5dc2b44d1c77b6
SHA512 2e8992c043352ee1622d52b7eda3d02ba4db10ee40c8b59362832704d6c5e0d2877071a742985b8c4b67390ec16c2693eb25364c490cecb113c6db5ed5f363fd
TLSH
T1FB219B260649955D26B345D5092CB42FA31FC0EF0E2BCD8D3E8D450F7BA2A0C5326746
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 035b46c349404e1c0709f8b8435066082eabb2533f40f9da43e552e99f854369
MD5 4d935a7b13ecb3acd4d8306616adbb0d
SHA1 981ed9b7c9315cd9555ef5d2eca9763e11096253
SHA512 6c76efc4e5381746d07d0d9c62e030ae04e12ce0e294f5fc34d3258ad77ad23a100784761dfb77c367ee6bf62639d8c60cf7e66728f526e270aac452bcd3c6bb
TLSH
T12C21AC260649956D26B345D5052CF46FA31FC0EB0E2BDD8D3E8E440E7BA2A1D5362645
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3100-11-0x000001FFEABE0000-0x000001FFEAC02000-memory.dmp

Download