3eeb6f5aa23ee4549ac632cf5eaa501df8637949d77e7c8b70d1c7e1b53a1a46

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 05:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
axontweakspatch/uninstall.bat
Size 1KB
Sample260816-fr128a1vbw
SHA256 3eeb6f5aa23ee4549ac632cf5eaa501df8637949d77e7c8b70d1c7e1b53a1a46
MD5 6a6fad33a786efd2e903e86a76a96817
SHA1 f3d98d0b29cdc7947863417ef7423b033ab64ef8
SHA512 7aa12a11293a5f5c0976040c575fa0b62c150064bb4b9fdb30fdf99e7b4570e5aa2edd65407dc45f1cbc96494b525524c7da2f331f9378f5738c01eb290c7d3e
TLSH
T1DD3192A2C7C1DF350CDA8953E46790A03B1A510B4315AEC272CB93D83E40ABC873C4C6
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3244	powershell.exe
1904	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4384	cmd.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3444	NETSTAT.EXE

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3444	NETSTAT.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3244	powershell.exe
3244	powershell.exe
1904	powershell.exe
1904	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3444	NETSTAT.EXE
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 4180	4384	cmd.exe	90
PID 4180 wrote to memory of 4872	4180	net.exe	91
PID 4384 wrote to memory of 3444	4384	cmd.exe	92
PID 4384 wrote to memory of 4532	4384	cmd.exe	93
PID 4384 wrote to memory of 3040	4384	cmd.exe	94
PID 4384 wrote to memory of 3244	4384	cmd.exe	95
PID 4384 wrote to memory of 1904	4384	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\axontweakspatch\uninstall.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4872
- C:\Windows\system32\NETSTAT.EXE
  netstat -ano
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:3444
- C:\Windows\system32\findstr.exe
  findstr ":443 "
  2⤵
  PID:4532
- C:\Windows\system32\findstr.exe
  findstr LISTENING
  2⤵
  PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$h='C:\Windows\System32\drivers\etc\hosts'; $c=Get-Content $h | Where-Object { $_ -notmatch 'api\.axonservices\.cc' }; Set-Content -Path $h -Value $c -Encoding ASCII"
  2⤵
  - Drops file in Drivers directory
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "if (Test-Path 'cert.cer') { $t=(New-Object System.Security.Cryptography.X509Certificates.X509Certificate2('cert.cer')).Thumbprint; foreach ($sn in @('Root','My')) { $st=New-Object System.Security.Cryptography.X509Certificates.X509Store($sn,'LocalMachine'); $st.Open('ReadWrite'); $f=@($st.Certificates | Where-Object { $_.Thumbprint -eq $t }); foreach ($x in $f) { $st.Remove($x) }; $st.Close() }; Write-Host '[3/3] cert removed from Trusted Root' } else { Write-Host '[3/3] cert.cer missing; nothing to remove' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1904-16-0x00000170784D0000-0x00000170785FF000-memory.dmp

Download

memory/3244-0-0x00007FFE9AF1F000-0x00007FFE9AF20000-memory.dmp

Download

memory/3244-3-0x00000268F52C0000-0x00000268F52E2000-memory.dmp

Download

memory/3244-4-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/3244-5-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/3244-6-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/3244-7-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/3244-10-0x00000268F56C0000-0x00000268F57EF000-memory.dmp

Download

memory/3244-11-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download