0ce99026f534eb9f6763c9df0bf27117dac8a09d82ea866ef1831ca8f5c81fc8

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 05:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
axontweakspatch/launch.bat
Size 3KB
Sample260816-fr128a1vbw
SHA256 0ce99026f534eb9f6763c9df0bf27117dac8a09d82ea866ef1831ca8f5c81fc8
MD5 63b65a0c6e8d1adf74214062daa95a12
SHA1 e569d11b580189d314e03c625b5bc4071549818e
SHA512 18cb15234f79ec72c2a50f050d02162a68c8d811e40941d8c8b513b0ad490cf8aa0087a8ffe75f6f9d2231dc25ef0639b77247cd3bd2ebb418ed84be6ca14cd9
TLSH
T19681961653498F3A19D94722896350A57A29808F02463EC371EFC2D67F0ADBCDBBC1C5
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	2864	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2864	powershell.exe
6048	powershell.exe
6124	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
248	cmd.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313304482828878"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2864	powershell.exe
2864	powershell.exe
2864	powershell.exe
2864	powershell.exe
6048	powershell.exe
6048	powershell.exe
6124	powershell.exe
6124	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	6048	powershell.exe
Token: SeDebugPrivilege	6124	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 248 wrote to memory of 1224	248	cmd.exe	90
PID 1224 wrote to memory of 4316	1224	net.exe	91
PID 248 wrote to memory of 5892	248	cmd.exe	92
PID 248 wrote to memory of 2864	248	cmd.exe	93
PID 248 wrote to memory of 6048	248	cmd.exe	95
PID 248 wrote to memory of 6124	248	cmd.exe	96
PID 248 wrote to memory of 3956	248	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\axontweakspatch\launch.bat"
1⤵
- Drops file in Drivers directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:248
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4316
- C:\Windows\system32\findstr.exe
  findstr /I /C:"api.axonservices.cc" "C:\Windows\System32\drivers\etc\hosts"
  2⤵
  PID:5892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $cn='api.axonservices.cc'; $pwd=ConvertTo-SecureString 'crackmepw' -Force -AsPlainText; if (-not (Test-Path 'cert.pfx')) { try { $cert=Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.DnsNameList -contains $cn -and $_.HasPrivateKey } | Select-Object -First 1; if ($cert) { try { Export-PfxCertificate -Cert $cert -FilePath 'cert.pfx' -Password $pwd -ErrorAction Stop | Out-Null } catch { Write-Host 'existing cert private key not exportable; generating a fresh one'; $cert=$null } }; if (-not $cert) { $cert=New-SelfSignedCertificate -DnsName $cn -CertStoreLocation Cert:\LocalMachine\My -KeyExportPolicy Exportable -KeyAlgorithm RSA -KeyLength 2048 -NotAfter (Get-Date).AddYears(5) }; Export-PfxCertificate -Cert $cert -FilePath 'cert.pfx' -Password $pwd -ErrorAction Stop | Out-Null; $st=New-Object System.Security.Cryptography.X509Certificates.X509Store('My','LocalMachine'); $st.Open('ReadWrite'); $old=@($st.Certificates | Where-Object { $_.DnsNameList -contains $cn -and $_.Thumbprint -ne $cert.Thumbprint }); foreach ($x in $old) { $st.Remove($x) }; $st.Close(); Write-Host '[2/4] certificate generated' } catch { Write-Host ('cert generation failed: ' + $_.Exception.Message); exit 1 } } else { Write-Host '[2/4] certificate already present' }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; try { if (-not (Test-Path 'cert.cer')) { $c=New-Object System.Security.Cryptography.X509Certificates.X509Certificate2('cert.pfx',(ConvertTo-SecureString 'crackmepw' -Force -AsPlainText)); Export-Certificate -Cert $c -FilePath 'cert.cer' -ErrorAction Stop | Out-Null } } catch { Write-Host ('cert.cer export failed: ' + $_.Exception.Message); exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; try { $t=(New-Object System.Security.Cryptography.X509Certificates.X509Certificate2('cert.cer')).Thumbprint; $st=New-Object System.Security.Cryptography.X509Certificates.X509Store('Root','LocalMachine'); $st.Open('ReadOnly'); $dup=@($st.Certificates | Where-Object { $_.Thumbprint -eq $t }).Count -gt 0; $st.Close(); if (-not $dup) { Import-Certificate -FilePath 'cert.cer' -CertStoreLocation Cert:\LocalMachine\Root -ErrorAction Stop | Out-Null; Write-Host '[2/4] cert installed in Trusted Root' } else { Write-Host '[2/4] cert already trusted' } } catch { Write-Host ('cert trust failed: ' + $_.Exception.Message); exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6124
- C:\Windows\system32\where.exe
  where node
  2⤵
  PID:3956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a441b427c5a163aea0a3e01e22c0e44ed80edc1cab4a0aca0f0f37f8b18415a5
MD5 5c4f4dd7317017c3e93ff24b3b3b3e0a
SHA1 53a6f075bdd7f4b3bae47442097ccaba18162fef
SHA512 ec30490eb4fbf316b1792b410150aef860e1623ecf598ad9d11bddadb7779b1823c41b716dddd372435a962c011a168a05c7afa7df121732b1be662b21f022aa
TLSH
T15F21AD37B3CD8625DC9A013A40CEEC1036B6C7D740DEDF9B7B84D654A42F699DE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f99cbbd342d6e4fbc286bc91c5810e526587aa8ed5ddf22f5aeddb2af1d2880c
MD5 8f05bbf3cb3da443919624cb78de465b
SHA1 f55cc5a8c93637544b4db951769a1965552a44e7
SHA512 ac9848b8bf9f8f8c0fabaa6ed69c41dbd57639150c290de44ff2446170b8fb86492f3bfd9e6cf991a0bf6d9d09fdfaac39bbe521f1cee2eeead5ecb34fd4b3e3
TLSH
T1BD21AD37B3CD8625DC8A013A00CEEC1036B6C7DB40DEDF9B7B84D654A42F699DE60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_nqihxpab.hlx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nqihxpab.hlx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cert.cer

Path C:\Users\Admin\AppData\Local\Temp\axontweakspatch\cert.cer
Size 826B
SHA256 4372e5074ae2ad83ca4b6331ffe89b5b7a6b3285c65254e87280451a6fca2cd7
MD5 485f903158509d01d262aafefc97820a
SHA1 6fe311c379323a41e3d7470536044a49c94ece33
SHA512 1f37669fc66934223c548572b47225e49c06c4596db5322a817ad85bbc6ad440444d864c15a7314df85d5ea187d28ac5ae669c3e3ec532fe9ed37e53d7376907
TLSH
T13701DA870FBCE421C942C8041FC4113F1E78C7452E0494D35D76446349620EA1B9723D
MD5 SHA1 SHA512 TLSH

Submit Download

cert.pfx

Path C:\Users\Admin\AppData\Local\Temp\axontweakspatch\cert.pfx
Size 2KB
SHA256 2f2213db98be960d4dff6ee2720d01297286495410eb950e124631164e73bdad
MD5 dd25370433f3e7b809784f89ba370052
SHA1 3f8c3e4680d4ccff4ceda4875ae98233460396d2
SHA512 ac39e4a14524f9e3ff14cd2c5dece7a9cd9dcf480f813c58c1e04a126db32e7499e65a89e7ccb6ee16ea1a3d6fe08991bb6ed1a5e3821b4c8af7cf56e10cc2b2
TLSH
T13E511B2A0EF68926395F657C8898551E10736F181EA1927F78B205C86946FD21B5E708
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2864-13-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/2864-19-0x000002654EB00000-0x000002654EB1E000-memory.dmp

Download

memory/2864-10-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/2864-11-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/2864-12-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/2864-1-0x00007FFA936DF000-0x00007FFA936E0000-memory.dmp

Download

memory/2864-17-0x000002654ED70000-0x000002654EE22000-memory.dmp

Download

memory/2864-16-0x000002654EAB0000-0x000002654EACE000-memory.dmp

Download

memory/2864-18-0x000002654EAD0000-0x000002654EADA000-memory.dmp

Download

memory/2864-9-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/2864-20-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/2864-21-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/2864-26-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/2864-8-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/2864-7-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/2864-6-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download

memory/2864-5-0x000002654EA10000-0x000002654EA32000-memory.dmp

Download

memory/2864-2-0x00007FFA93550000-0x00007FFA93EF4000-memory.dmp

Download