Analysis
- max time kernel
149s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/08/2026, 20:17
General
- Target Test.bat
- Size 5KB
- Sample260812-y25r9sstd1
- SHA256 c352dce6340737fd2ccc6800f42c65eb0d5819c5451d452ea62a9e511e71b6a2
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Test.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "^2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4228-0-0x00007FFA836AF000-0x00007FFA836B0000-memory.dmp
memory/4228-3-0x00000177CB050000-0x00000177CB072000-memory.dmp
memory/4228-4-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/4228-5-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/4228-8-0x00000177CB110000-0x00000177CB12E000-memory.dmp
memory/4228-10-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/4228-9-0x00000177CB130000-0x00000177CB1E2000-memory.dmp
memory/4228-11-0x00000177CB100000-0x00000177CB10A000-memory.dmp
memory/4228-12-0x00000177CB690000-0x00000177CB6AE000-memory.dmp
memory/4228-13-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/4228-14-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/4228-15-0x00000177CB1F0000-0x00000177CB1FA000-memory.dmp
memory/4228-16-0x00000177CB6B0000-0x00000177CB6CC000-memory.dmp
memory/4228-17-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/4228-18-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/4228-19-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/4228-20-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/4228-21-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/4228-22-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/4228-23-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/4228-24-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/4228-25-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/4228-26-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/4228-27-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/4228-30-0x00000177CB430000-0x00000177CB43A000-memory.dmp
memory/4228-29-0x00000177CB420000-0x00000177CB426000-memory.dmp
memory/4228-28-0x00000177CB410000-0x00000177CB418000-memory.dmp
memory/4228-32-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp
memory/4228-33-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp