9a55d180e34c66c844163b5299a446212ed7fa42c80fa0225b13f86448bc0bbc

Analysis

max time kernel
898s
max time network
440s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
launch.bat
Size 3KB
Sample260815-vpg9nazfpf
SHA256 9a55d180e34c66c844163b5299a446212ed7fa42c80fa0225b13f86448bc0bbc
MD5 11274329259ea0844d9070c4a5cd94cf
SHA1 bf718f5d422efec43fe37cf23c42c0cc676c2510
SHA512 c03970c6f7c748432a2afa857d548f0ce2125ee20bfe3633b625db834fcad0574ee8e47dabb37a757d984b03b0990a24f089474294623ec7ef474a4a69a8a513
TLSH
T10F81861653498F3A19D94722896350A57A29808F03563EC371EFC2D67F0ADBCDBBC5C5
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4884	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4884	powershell.exe
6036	powershell.exe
2288	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5392	cmd.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312873980184457"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe
6036	powershell.exe
6036	powershell.exe
2288	powershell.exe
2288	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeDebugPrivilege	6036	powershell.exe
Token: SeDebugPrivilege	2288	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5392 wrote to memory of 1116	5392	cmd.exe	90
PID 1116 wrote to memory of 4284	1116	net.exe	91
PID 5392 wrote to memory of 5400	5392	cmd.exe	92
PID 5392 wrote to memory of 4884	5392	cmd.exe	93
PID 5392 wrote to memory of 6036	5392	cmd.exe	95
PID 5392 wrote to memory of 2288	5392	cmd.exe	96
PID 5392 wrote to memory of 3556	5392	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\launch.bat"
1⤵
- Drops file in Drivers directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4284
- C:\Windows\system32\findstr.exe
  findstr /I /C:"api.axonservices.cc" "C:\Windows\System32\drivers\etc\hosts"
  2⤵
  PID:5400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $cn='api.axonservices.cc'; $pwd=ConvertTo-SecureString 'crackmepw' -Force -AsPlainText; if (-not (Test-Path 'cert.pfx')) { try { $cert=Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.DnsNameList -contains $cn -and $_.HasPrivateKey } | Select-Object -First 1; if ($cert) { try { Export-PfxCertificate -Cert $cert -FilePath 'cert.pfx' -Password $pwd -ErrorAction Stop | Out-Null } catch { Write-Host 'existing cert private key not exportable; generating a fresh one'; $cert=$null } }; if (-not $cert) { $cert=New-SelfSignedCertificate -DnsName $cn -CertStoreLocation Cert:\LocalMachine\My -KeyExportPolicy Exportable -KeyAlgorithm RSA -KeyLength 2048 -NotAfter (Get-Date).AddYears(5) }; Export-PfxCertificate -Cert $cert -FilePath 'cert.pfx' -Password $pwd -ErrorAction Stop | Out-Null; $st=New-Object System.Security.Cryptography.X509Certificates.X509Store('My','LocalMachine'); $st.Open('ReadWrite'); $old=@($st.Certificates | Where-Object { $_.DnsNameList -contains $cn -and $_.Thumbprint -ne $cert.Thumbprint }); foreach ($x in $old) { $st.Remove($x) }; $st.Close(); Write-Host '[2/4] certificate generated' } catch { Write-Host ('cert generation failed: ' + $_.Exception.Message); exit 1 } } else { Write-Host '[2/4] certificate already present' }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; try { if (-not (Test-Path 'cert.cer')) { $c=New-Object System.Security.Cryptography.X509Certificates.X509Certificate2('cert.pfx',(ConvertTo-SecureString 'crackmepw' -Force -AsPlainText)); Export-Certificate -Cert $c -FilePath 'cert.cer' -ErrorAction Stop | Out-Null } } catch { Write-Host ('cert.cer export failed: ' + $_.Exception.Message); exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; try { $t=(New-Object System.Security.Cryptography.X509Certificates.X509Certificate2('cert.cer')).Thumbprint; $st=New-Object System.Security.Cryptography.X509Certificates.X509Store('Root','LocalMachine'); $st.Open('ReadOnly'); $dup=@($st.Certificates | Where-Object { $_.Thumbprint -eq $t }).Count -gt 0; $st.Close(); if (-not $dup) { Import-Certificate -FilePath 'cert.cer' -CertStoreLocation Cert:\LocalMachine\Root -ErrorAction Stop | Out-Null; Write-Host '[2/4] cert installed in Trusted Root' } else { Write-Host '[2/4] cert already trusted' } } catch { Write-Host ('cert trust failed: ' + $_.Exception.Message); exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2288
- C:\Windows\system32\where.exe
  where node
  2⤵
  PID:3556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4672

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 605610c3d9437591dd26d0aa5883c4c05d10b26c5ba6c641f4b02f5ca2c0d368
MD5 b4b04654a3529a52918e96d777debe48
SHA1 ff075c53b6072709d40e402e5bff1529d2c5316e
SHA512 e4d684dea176202d11dfd015d00fd5882ce4a919b0b13589debc04a3213a976bb92a4520e2d10495faaf0e6906070941d86577b1aacf22aed1912e5bd38efbe1
TLSH
T10D21BE37B3CC8620C889013A00CDEC1136B6C7D780DEDE5B7B84D658A42F699DE61150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 961003bf34f08fa5d0d9d80c46af59a930a4ace3b19f5d5cd9c578e5907a4e91
MD5 d2e6e065cecfae9e1d38947a02cf1331
SHA1 f7aed6ec35ceef8fc23fa5b224ae5d844ed216f6
SHA512 ce475dde50b0925f5167dbb836547a3f875a2c41da0ef30e359d89eecc6e73eaf7f31b8162bb9a0b6024eac5d5be5b1065b5bdfa7543ea0e9e34eb649c53204f
TLSH
T1A7218B37B3CD8665D889013A40CEEC1035A7C7DB40DEDEDB6B84D559A02F695CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cgoc25ih.ivh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cgoc25ih.ivh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cert.cer

Path C:\Users\Admin\AppData\Local\Temp\cert.cer
Size 826B
SHA256 0c37c5584989182f865ee4c429b2b851dba44df77a2afbba4aaf8e566ee37996
MD5 840a8c4a40a1f9565900c08305df1603
SHA1 00b9957cba58c4180f04784f3adb9a2376b07cf4
SHA512 9e203deed80735e048de0fb80b3b04cc9dbaffd0131a0c2b7ef5ea6b36b70f9fb6451d816079151815ab7e89c36023db0f512907fed695c68d0012202e7ded50
TLSH
T1FF01463F076838C5D6CA581C5F4B25171E75CB604C61B90FEEBB485D0E195DE444A51F
MD5 SHA1 SHA512 TLSH

Submit Download

cert.pfx

Path C:\Users\Admin\AppData\Local\Temp\cert.pfx
Size 2KB
SHA256 d97fd3b0d57cd1c2b1db529924a8d669d419d94e76768080ab91fcc926470cba
MD5 0dc8e4d39f9c1652d222b6624169c98c
SHA1 4c3c6ba1b9500ede313b6ac202d80aa821f4db42
SHA512 d85e0b549d09718db4b2e967148b71aa7b562c0fc2b3ff070571c47a9fc511ae83f696c6a14952ea1b88b0590335dd1bdd99f3717b00671182c761c39d675f52
TLSH
T1B95128034EBE2AA33CAFDC6450380B2984305B129B50E60F71330FE15D27924BCED553
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4884-10-0x000002561D320000-0x000002561D33E000-memory.dmp

Download

memory/4884-19-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/4884-12-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/4884-13-0x000002561D110000-0x000002561D11A000-memory.dmp

Download

memory/4884-15-0x000002561D570000-0x000002561D58E000-memory.dmp

Download

memory/4884-14-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/4884-16-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/4884-17-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/4884-18-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/4884-1-0x00007FF8489FF000-0x00007FF848A00000-memory.dmp

Download

memory/4884-20-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/4884-27-0x000002561D650000-0x000002561D695000-memory.dmp

Download

memory/4884-28-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/4884-11-0x000002561D340000-0x000002561D3F2000-memory.dmp

Download

memory/4884-7-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/4884-5-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/4884-6-0x00007FF848870000-0x00007FF849214000-memory.dmp

Download

memory/4884-4-0x000002561D0C0000-0x000002561D0E2000-memory.dmp

Download

memory/6036-34-0x0000016FFAF90000-0x0000016FFB042000-memory.dmp

Download