00c0f5856b30a76be23c5af9053280b2025d6ed62e33d3b599733ce6b6d830f1

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 10:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LAUNCHER.bat
Size 393B
Sample260814-my5sbasthx
SHA256 00c0f5856b30a76be23c5af9053280b2025d6ed62e33d3b599733ce6b6d830f1
MD5 4227591794b4f124d4b9526ffb068515
SHA1 2a3a865ead848210aff105619c51ed6c6bfa06b6
SHA512 320a8d32f18e936f045fc3a6cf86fe039ea70b2bc534267671c8906d2d897b809151e9f7f26c232ad43a592ae7bbc31dbce5b98ff9ebbd37879e482c090c5010
TLSH
T1BFE0F10126EA03BF8334E541C15821A5ED5C634B301844DA32A1A1743B05580C7F4CCC
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4896	powershell.exe
2432	powershell.exe
5072	powershell.exe
256	powershell.exe
5136	powershell.exe
3916	powershell.exe
5476	powershell.exe
2264	powershell.exe
3296	powershell.exe
1192	powershell.exe
3812	powershell.exe
5376	powershell.exe
4956	powershell.exe
5816	powershell.exe
1600	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3316	cmd.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5872	ipconfig.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
4956	powershell.exe
4956	powershell.exe
5816	powershell.exe
5816	powershell.exe
5816	powershell.exe
1192	powershell.exe
1192	powershell.exe
1600	powershell.exe
1600	powershell.exe
5136	powershell.exe
5136	powershell.exe
3916	powershell.exe
3916	powershell.exe
3812	powershell.exe
3812	powershell.exe
5476	powershell.exe
5476	powershell.exe
2264	powershell.exe
2264	powershell.exe
5072	powershell.exe
5072	powershell.exe
5376	powershell.exe
5376	powershell.exe
4896	powershell.exe
4896	powershell.exe
3296	powershell.exe
3296	powershell.exe
256	powershell.exe
256	powershell.exe
2432	powershell.exe
2432	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeDebugPrivilege	5816	powershell.exe
Token: SeDebugPrivilege	1192	powershell.exe
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeDebugPrivilege	5136	powershell.exe
Token: SeDebugPrivilege	3916	powershell.exe
Token: SeDebugPrivilege	3812	powershell.exe
Token: SeDebugPrivilege	5476	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeDebugPrivilege	5376	powershell.exe
Token: SeDebugPrivilege	4896	powershell.exe
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeDebugPrivilege	256	powershell.exe
Token: SeDebugPrivilege	2432	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 4176	3316	cmd.exe	90
PID 4176 wrote to memory of 4196	4176	net.exe	91
PID 3316 wrote to memory of 4956	3316	cmd.exe	92
PID 4956 wrote to memory of 5872	4956	powershell.exe	93
PID 4956 wrote to memory of 3284	4956	powershell.exe	94
PID 4956 wrote to memory of 4900	4956	powershell.exe	95
PID 4956 wrote to memory of 5816	4956	powershell.exe	96
PID 4956 wrote to memory of 352	4956	powershell.exe	98
PID 4956 wrote to memory of 1192	4956	powershell.exe	99
PID 4956 wrote to memory of 1600	4956	powershell.exe	101
PID 4956 wrote to memory of 5136	4956	powershell.exe	103
PID 4956 wrote to memory of 3916	4956	powershell.exe	105
PID 4956 wrote to memory of 3812	4956	powershell.exe	107
PID 4956 wrote to memory of 5476	4956	powershell.exe	109
PID 4956 wrote to memory of 2264	4956	powershell.exe	111
PID 4956 wrote to memory of 5072	4956	powershell.exe	113
PID 4956 wrote to memory of 5376	4956	powershell.exe	115
PID 4956 wrote to memory of 4896	4956	powershell.exe	117
PID 4956 wrote to memory of 3296	4956	powershell.exe	119
PID 4956 wrote to memory of 256	4956	powershell.exe	121
PID 4956 wrote to memory of 2432	4956	powershell.exe	123

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\LAUNCHER.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\LAUNCHER.ps1"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /flushdns
    3⤵
    - Gathers network information
    PID:5872
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" interface portproxy delete v4tov4 listenport=443 listenaddress=127.0.0.1
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3284
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" interface portproxy add v4tov4 listenport=443 listenaddress=127.0.0.1 connectport=4443 connectaddress=127.0.0.1
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5816
- - C:\Users\Admin\AppData\Local\Temp\REBOOTEDSPOOFER.exe
    "C:\Users\Admin\AppData\Local\Temp\REBOOTEDSPOOFER.exe"
    3⤵
    PID:352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5476
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 9184a425e20d7e45bc653b61164a5b48200ba83d2c46df2c94227fdc17b79af4
MD5 97ef5fc4f03645e585b0ead64488f8db
SHA1 e6c85461cb7630842d339b14b5941ba964f01eec
SHA512 b74a8045f9cda500d245a4afdf6edd25c28548c3cff3a5a2df64de478b3f8df81ce9be5a0a8667ba417de6454318cc25aa586623eb77fe26cb483ff7ed870c1b
SSDEEP 1536:rKLmHhYoiz8KMSfKQ1CflJntCUp9Y3h4iUxAR40i71Yi68nv2gOdB4V3CNBQkj2E:rKLmHhYoiz8KMSfKQ1CflJnQUp9Y3qif
TLSH
T155637392E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_inal3qau.dix.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_inal3qau.dix.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4956-20-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-23-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-6-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-7-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-8-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-9-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-10-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-11-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-12-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-13-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-24-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-17-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-16-0x00000279EE9B0000-0x00000279EE9CE000-memory.dmp

Download

memory/4956-19-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-21-0x00000279EE9D0000-0x00000279EE9DA000-memory.dmp

Download

memory/4956-22-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-4-0x00000279EE950000-0x00000279EE972000-memory.dmp

Download

memory/4956-0-0x00007FFB193CF000-0x00007FFB193D0000-memory.dmp

Download

memory/4956-18-0x00000279EEDB0000-0x00000279EEE62000-memory.dmp

Download

memory/4956-25-0x00000279EEB20000-0x00000279EEB3E000-memory.dmp

Download

memory/4956-28-0x00000279EF240000-0x00000279EF3B6000-memory.dmp

Download

memory/4956-29-0x00000279EF5D0000-0x00000279EF7DA000-memory.dmp

Download

memory/4956-5-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-3-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-44-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-36-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-37-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-38-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/4956-43-0x00007FFB19240000-0x00007FFB19BE4000-memory.dmp

Download

memory/5816-40-0x000001323EEA0000-0x000001323EEA6000-memory.dmp

Download

memory/5816-41-0x000001323EEB0000-0x000001323EEBA000-memory.dmp

Download

memory/5816-39-0x000001323EE70000-0x000001323EE78000-memory.dmp

Download

memory/5816-35-0x000001323EEC0000-0x000001323EEDC000-memory.dmp

Download

memory/5816-34-0x000001323EE60000-0x000001323EE6A000-memory.dmp

Download