9a55d180e34c66c844163b5299a446212ed7fa42c80fa0225b13f86448bc0bbc

Analysis

user interaction
yes
max time kernel
898s
max time network
397s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
launch.bat
Size 3KB
Sample260815-vpg9nazfpf
SHA256 9a55d180e34c66c844163b5299a446212ed7fa42c80fa0225b13f86448bc0bbc
MD5 11274329259ea0844d9070c4a5cd94cf
SHA1 bf718f5d422efec43fe37cf23c42c0cc676c2510
SHA512 c03970c6f7c748432a2afa857d548f0ce2125ee20bfe3633b625db834fcad0574ee8e47dabb37a757d984b03b0990a24f089474294623ec7ef474a4a69a8a513
TLSH
T10F81861653498F3A19D94722896350A57A29808F03563EC371EFC2D67F0ADBCDBBC5C5
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	1412	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2224	powershell.exe
2968	powershell.exe
1412	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2676	cmd.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312873953395766"	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1412	powershell.exe
1412	powershell.exe
1412	powershell.exe
1412	powershell.exe
2224	powershell.exe
2224	powershell.exe
2968	powershell.exe
2968	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	2968	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2348	2676	cmd.exe	86
PID 2348 wrote to memory of 2764	2348	net.exe	87
PID 2676 wrote to memory of 4732	2676	cmd.exe	88
PID 2676 wrote to memory of 1412	2676	cmd.exe	89
PID 2676 wrote to memory of 2224	2676	cmd.exe	91
PID 2676 wrote to memory of 2968	2676	cmd.exe	92
PID 2676 wrote to memory of 4808	2676	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\launch.bat"
1⤵
- Drops file in Drivers directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2764
- C:\Windows\system32\findstr.exe
  findstr /I /C:"api.axonservices.cc" "C:\Windows\System32\drivers\etc\hosts"
  2⤵
  PID:4732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $cn='api.axonservices.cc'; $pwd=ConvertTo-SecureString 'crackmepw' -Force -AsPlainText; if (-not (Test-Path 'cert.pfx')) { try { $cert=Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.DnsNameList -contains $cn -and $_.HasPrivateKey } | Select-Object -First 1; if ($cert) { try { Export-PfxCertificate -Cert $cert -FilePath 'cert.pfx' -Password $pwd -ErrorAction Stop | Out-Null } catch { Write-Host 'existing cert private key not exportable; generating a fresh one'; $cert=$null } }; if (-not $cert) { $cert=New-SelfSignedCertificate -DnsName $cn -CertStoreLocation Cert:\LocalMachine\My -KeyExportPolicy Exportable -KeyAlgorithm RSA -KeyLength 2048 -NotAfter (Get-Date).AddYears(5) }; Export-PfxCertificate -Cert $cert -FilePath 'cert.pfx' -Password $pwd -ErrorAction Stop | Out-Null; $st=New-Object System.Security.Cryptography.X509Certificates.X509Store('My','LocalMachine'); $st.Open('ReadWrite'); $old=@($st.Certificates | Where-Object { $_.DnsNameList -contains $cn -and $_.Thumbprint -ne $cert.Thumbprint }); foreach ($x in $old) { $st.Remove($x) }; $st.Close(); Write-Host '[2/4] certificate generated' } catch { Write-Host ('cert generation failed: ' + $_.Exception.Message); exit 1 } } else { Write-Host '[2/4] certificate already present' }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; try { if (-not (Test-Path 'cert.cer')) { $c=New-Object System.Security.Cryptography.X509Certificates.X509Certificate2('cert.pfx',(ConvertTo-SecureString 'crackmepw' -Force -AsPlainText)); Export-Certificate -Cert $c -FilePath 'cert.cer' -ErrorAction Stop | Out-Null } } catch { Write-Host ('cert.cer export failed: ' + $_.Exception.Message); exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; try { $t=(New-Object System.Security.Cryptography.X509Certificates.X509Certificate2('cert.cer')).Thumbprint; $st=New-Object System.Security.Cryptography.X509Certificates.X509Store('Root','LocalMachine'); $st.Open('ReadOnly'); $dup=@($st.Certificates | Where-Object { $_.Thumbprint -eq $t }).Count -gt 0; $st.Close(); if (-not $dup) { Import-Certificate -FilePath 'cert.cer' -CertStoreLocation Cert:\LocalMachine\Root -ErrorAction Stop | Out-Null; Write-Host '[2/4] cert installed in Trusted Root' } else { Write-Host '[2/4] cert already trusted' } } catch { Write-Host ('cert trust failed: ' + $_.Exception.Message); exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\system32\where.exe
  where node
  2⤵
  PID:4808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 9ad73d7d5e25549e3a2a77cfe4593e916379a94b854608bd3eb84846c02911fd
MD5 734434374b57e1f7f97aa22ce1f3d662
SHA1 ee0a978e6785f782229b7b5d00618f4aeb2d4ae8
SHA512 42e777a90bb2ab1ada78f5ad61f8e7d04f94f92af7fb9360041cfb373b074112507d9b637a9e59fdf70a2ceef3f65d2244704052ed432a11ec7494c01ea5d5e2
TLSH
T1DD71FE313375B0E4C8563F072A6819C063BF4396EA94AF4CB258621EDD2741B9F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 eddded176b9faca54551850726f372a3dbd606f57125f7c0a68235cb600d7922
MD5 365ccaa93454ccb3b7ec54d34a5808a2
SHA1 cabf0167c97478663866e443f68fa522d1caecb2
SHA512 1d95c1fc0f8e21e62a401a732122de12e05c2ded45b75561352bf16526bf36c4c152d681cb54f542c841d75bcae2a963f0cc034a6a7c96c976b1b4151a2956be
TLSH
T18D218727B3DD9921DC86123A009D9C5076B693C7809EDF9FABC0D610A0BFA99CB25290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 77f555c401de5592c8e5135f66595fac495487aa989d3d7b0548129f95a980f7
MD5 508c18b3c0779cf209472d392e68dd1e
SHA1 bee9be52b9d881dc2287f9ef93c6487298816507
SHA512 03d52d16d7487cd5dde57dfbf9f53cc364821c68f53425f58620a05b0cfdddfc240fd246396d431ad193d5fc9e59574ac53f1b6d6fbae29e4ae5472d43612c1c
TLSH
T1C4218727B3DC9921DC96123A009D9C1176A683C7809FDF9F6BC0D61490BF999CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cmucd5ow.m5s.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cmucd5ow.m5s.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cert.cer

Path C:\Users\Admin\AppData\Local\Temp\cert.cer
Size 826B
SHA256 9bae342e16cd8d854ee1734a42929fc15102ebf56f29c6c962d4e5f780567bbd
MD5 788e3540b0f2e866fb5fea3aecefdf1e
SHA1 687fd64e7fe77179bce5b9fc124465dfda9b4fcb
SHA512 18c3b2a8b6d21b7e8f64678d340592c322cde54cd7933a24fe69e2f985a3d8aa788c2bc8d643855835943845bc1731b09bf2934538875af9cf82bcd369da5796
TLSH
T12301416A3F6F3E9CD1C38C35208869236EF1E1AA5B46499A52758C46CE21EBA8547029
MD5 SHA1 SHA512 TLSH

Submit Download

cert.pfx

Path C:\Users\Admin\AppData\Local\Temp\cert.pfx
Size 2KB
SHA256 f4207ac843cf26aa9d665dfd472b94d144805279f27756036664e1da9953444b
MD5 97b166efeb6c2bb1108a847422ae603e
SHA1 cfc2cd57bd416750705b46413123566f5e63fe72
SHA512 ac82a24de2ddd094554b999193a36c819a36195da6517e76a108815060e73d38ecb4d9a058409540362be9505cfaa60a863adf63c4c98c86f3e352dcd334ae3c
TLSH
T1B4510B8767FD02957DB449AE2054450A2EA5FF7221F1991DDA3209F94171450FB5C346
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1412-8-0x000002E19BAF0000-0x000002E19BB12000-memory.dmp

Download

memory/1412-20-0x000002E19C220000-0x000002E19C54D000-memory.dmp

Download

memory/1412-19-0x000002E19BB20000-0x000002E19BD3C000-memory.dmp

Download

memory/1412-11-0x000002E183890000-0x000002E1838A0000-memory.dmp

Download

memory/1412-2-0x000002E183890000-0x000002E1838A0000-memory.dmp

Download

memory/1412-1-0x000002E183890000-0x000002E1838A0000-memory.dmp

Download

memory/2968-43-0x000001C323620000-0x000001C32383C000-memory.dmp

Download