37af4c4519fe8fe3331d56e74ff2be57c09a46041b32c5a3233acc243b456945

Analysis

max time kernel
899s
max time network
457s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 07:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TraceX Final/Run-TraceX-HWID-Spoofer.bat
Size 6KB
Sample260816-jsc9bsshpa
SHA256 37af4c4519fe8fe3331d56e74ff2be57c09a46041b32c5a3233acc243b456945
MD5 4f98523504c362ef51a4c82768e8b51a
SHA1 8d3c001925d58761b5707f8a10d662d7b77416c6
SHA512 95baf291c47eb91da07ba20025df0c93b54e9b06bc1afd5f2090a991ade6b50a88083472543377d1b8f6c55b50c9e0d8ec231735114291b02b5997f2972dbbfb
SSDEEP 192:H55Iq2WQKBJ+mglJIqL1WRDK6DFD66DFOQDF:Z/QNPGe6pW65OQZ
TLSH
T1A3D12122342E97760ABED52884250069F55A62CF61085EFDF1AFD1781F38384DBFE5C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4084	powershell.exe
4356	powershell.exe
1584	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4840	cmd.exe
720	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4084	powershell.exe
4084	powershell.exe
4356	powershell.exe
4356	powershell.exe
1584	powershell.exe
1584	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4084	powershell.exe
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 2204	4840	cmd.exe	90
PID 4840 wrote to memory of 720	4840	cmd.exe	91
PID 720 wrote to memory of 4084	720	cmd.exe	92
PID 4840 wrote to memory of 4356	4840	cmd.exe	93
PID 4840 wrote to memory of 1584	4840	cmd.exe	94
PID 4840 wrote to memory of 1860	4840	cmd.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TraceX Final\Run-TraceX-HWID-Spoofer.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:2204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Get-ExecutionPolicy -Scope CurrentUser" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-ExecutionPolicy -Scope CurrentUser"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$blocked = Get-ChildItem -Path 'C:\Users\Admin\AppData\Local\Temp\TraceX Final\' -Recurse | Where-Object { $_.IsBlocked }; if ($blocked) { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Write-Host 'Test' | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\system32\choice.exe
  choice /C YN /M "Would you like to configure PowerShell now"
  2⤵
  PID:1860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3952

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9d602c8d16b6de9803b3ed6ff7b807cd1ab5655ed55a9e8ab503f000533ee0f2
MD5 f5d92aa4b0681cef7929c65e54761d76
SHA1 f95385201ae612a5f5e4f7d814faa2a7a9849358
SHA512 c0cd5b286b318efad478ef0285bd12cbaa62690a18a270289aec1b087e2fd3c8c98387c74e831f75ea4c73af80bcfe54e28eaf2d3166f74d11dbc9df580f903d
TLSH
T13C215C37B3DC8614C89A413A10CEEC1136B6C7DB81DECEAB7B94D559A43F299CE61150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f841a19063117d1941dadeaaa3e67fa4e985d238ef23e035f9c8623f1f247b34
MD5 f87c950dccddf53e5e36ac095b1de707
SHA1 0ecfa6697658d38273b382f37720af4a1c9bf550
SHA512 6e32ad4c2afd6fdbc53e962647c48d1bbafe0440f42a887d6d616c063e2bf376d7341e47402ef567411acef1c610468e607c95e2ebc113fbbc6e9a10de1f1ab4
TLSH
T1CE115733F3CC8624C89A403650CEAC1036B587DB509ECE6BBB84D154B43F5A9CE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mrxmdxfq.qic.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mrxmdxfq.qic.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4084-12-0x000002B9A89F0000-0x000002B9A8A0E000-memory.dmp

Download

memory/4084-14-0x000002B9A89E0000-0x000002B9A89EA000-memory.dmp

Download

memory/4084-7-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4084-8-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4084-9-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4084-5-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4084-13-0x000002B9A8C70000-0x000002B9A8D22000-memory.dmp

Download

memory/4084-6-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4084-15-0x000002B9A8A30000-0x000002B9A8A4E000-memory.dmp

Download

memory/4084-17-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4084-18-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4084-0-0x00007FFA95AFF000-0x00007FFA95B00000-memory.dmp

Download

memory/4084-40-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4084-4-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4084-3-0x000002B9A89A0000-0x000002B9A89C2000-memory.dmp

Download

memory/4356-19-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4356-25-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4356-26-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4356-27-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4356-28-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4356-29-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4356-30-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4356-31-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4356-32-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4356-34-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4356-35-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4356-21-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download

memory/4356-20-0x00007FFA95970000-0x00007FFA96314000-memory.dmp

Download