3478c721b327da40bb84eb4f48327477d2be278ec8403fbedaf66f88c6f6e1f3

Analysis

max time kernel
298s
max time network
290s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
حل مشاكل/حل مشكله ابيك قيمز.bat
Size 2KB
Sample260824-p5dnhsde33
SHA256 3478c721b327da40bb84eb4f48327477d2be278ec8403fbedaf66f88c6f6e1f3
MD5 a40d831679839adf883b7a5fd42a1d65
SHA1 35a1194bf2ff3b0fb3c89b549ac5167148c5a2bc
SHA512 f88c52c2de3eb8e633f60f4a8e6e4e2ba8fe87f1305bec3cc4eb26055cd96c0a39ba0e01a219d83941b65c790cdbaf2e90435cd6aae2becca25b73e19dc60046
TLSH
T19351D0033D78FC798085CAA09BE7A565ED444E8B00093DE4D4F6327BC568B8B927DD49
MD5 SHA1 SHA512 TLSH

Score

6^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4916	powershell.exe
4308	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4916	powershell.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2644	sc.exe
3696	sc.exe
2948	sc.exe
3640	sc.exe
3208	sc.exe
2628	sc.exe
1936	sc.exe
860	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4456	cmd.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2252	ipconfig.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
2780	taskkill.exe
1964	taskkill.exe
1956	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4916	powershell.exe
4916	powershell.exe
4308	powershell.exe
4308	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeDebugPrivilege	1956	taskkill.exe
Token: SeDebugPrivilege	2780	taskkill.exe
Token: SeDebugPrivilege	1964	taskkill.exe
Token: SeDebugPrivilege	4308	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3448	OpenWith.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 1992	4456	cmd.exe	87
PID 1992 wrote to memory of 1160	1992	net.exe	88
PID 4456 wrote to memory of 2644	4456	cmd.exe	89
PID 4456 wrote to memory of 3764	4456	cmd.exe	90
PID 3764 wrote to memory of 4976	3764	net.exe	91
PID 4456 wrote to memory of 3696	4456	cmd.exe	92
PID 4456 wrote to memory of 2056	4456	cmd.exe	93
PID 2056 wrote to memory of 1032	2056	net.exe	94
PID 4456 wrote to memory of 2948	4456	cmd.exe	95
PID 4456 wrote to memory of 4300	4456	cmd.exe	96
PID 4300 wrote to memory of 4160	4300	net.exe	97
PID 4456 wrote to memory of 3640	4456	cmd.exe	102
PID 4456 wrote to memory of 4332	4456	cmd.exe	103
PID 4332 wrote to memory of 5020	4332	net.exe	104
PID 4456 wrote to memory of 3208	4456	cmd.exe	106
PID 4456 wrote to memory of 4592	4456	cmd.exe	107
PID 4592 wrote to memory of 2320	4592	net.exe	108
PID 4456 wrote to memory of 2628	4456	cmd.exe	118
PID 4456 wrote to memory of 4404	4456	cmd.exe	119
PID 4404 wrote to memory of 968	4404	net.exe	120
PID 4456 wrote to memory of 1936	4456	cmd.exe	121
PID 4456 wrote to memory of 860	4456	cmd.exe	122
PID 4456 wrote to memory of 4916	4456	cmd.exe	123
PID 4456 wrote to memory of 1956	4456	cmd.exe	124
PID 4456 wrote to memory of 2780	4456	cmd.exe	125
PID 4456 wrote to memory of 1964	4456	cmd.exe	126
PID 4456 wrote to memory of 2252	4456	cmd.exe	127
PID 4456 wrote to memory of 3968	4456	cmd.exe	128
PID 4456 wrote to memory of 4308	4456	cmd.exe	129

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\حل مشاكل\حل مشكله ابيك قيمز.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1160
- C:\Windows\system32\sc.exe
  sc config EpicGamesUpdater start= auto
  2⤵
  - Launches sc.exe
  PID:2644
- C:\Windows\system32\net.exe
  net start EpicGamesUpdater
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start EpicGamesUpdater
    3⤵
    PID:4976
- C:\Windows\system32\sc.exe
  sc config EpicOnlineServices start= auto
  2⤵
  - Launches sc.exe
  PID:3696
- C:\Windows\system32\net.exe
  net start EpicOnlineServices
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start EpicOnlineServices
    3⤵
    PID:1032
- C:\Windows\system32\sc.exe
  sc config BITS start= auto
  2⤵
  - Launches sc.exe
  PID:2948
- C:\Windows\system32\net.exe
  net start BITS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start BITS
    3⤵
    PID:4160
- C:\Windows\system32\sc.exe
  sc config InstallService start= auto
  2⤵
  - Launches sc.exe
  PID:3640
- C:\Windows\system32\net.exe
  net start InstallService
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start InstallService
    3⤵
    PID:5020
- C:\Windows\system32\sc.exe
  sc config PushToInstall start= auto
  2⤵
  - Launches sc.exe
  PID:3208
- C:\Windows\system32\net.exe
  net start PushToInstall
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start PushToInstall
    3⤵
    PID:2320
- C:\Windows\system32\sc.exe
  sc config DoSvc start= auto
  2⤵
  - Launches sc.exe
  PID:2628
- C:\Windows\system32\net.exe
  net start DoSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 start DoSvc
    3⤵
    PID:968
- C:\Windows\system32\sc.exe
  sc config EasyAntiCheat start= demand
  2⤵
  - Launches sc.exe
  PID:1936
- C:\Windows\system32\sc.exe
  sc config EasyAntiCheat_EOS start= demand
  2⤵
  - Launches sc.exe
  PID:860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-Service -Name '*Epic*' -ErrorAction SilentlyContinue | Set-Service -StartupType Automatic -Status Running"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4916
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicOnlineServices.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicWebHelper.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1964
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:2252
- C:\Windows\system32\netsh.exe
  netsh winsock reset
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "if (Test-Path 'C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe') { Start-Process 'C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe' } elseif (Test-Path 'C:\Program Files\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe') { Start-Process 'C:\Program Files\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe' } else { Start-Process 'com.epicgames.launcher://' }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s PushToInstall
1⤵
PID:4620

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 73123d6e562b26b1fd2cf4fece67930d95fc4738bad8d1f386345a5311274739
MD5 92f89789864052cac0862ed6b4f1e706
SHA1 aa6594951427e103fa025c8ebef3ec5a5f85866c
SHA512 71a0261ee6ffcd2e9bb336dde7110f80ac6fa01df5433e77cc170649b7936653d89229255fbeac15692e8736c9f3e5d15d62b2372865fe3d7ab933c511c2894e
TLSH
T1D0610D313375F1E888167F071E28198053BF4355EA94AF5CB298621EEA2741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 600c1bcc690b0fc1324d2f107e28fbc937f2ae2bc207760aea6bcbc161141435
MD5 3894b68591c20ec493bc0ee1dfc3eb30
SHA1 2bd41844395972876c8d8b03e85477e5f2241771
SHA512 32f0c247b11ce002f768f77d652089af84190ff19ca4445236ec03cdc942482367425fbbd13321a29f199eb298f15a4badb840e170f63c64fd2b5e4553511b3e
TLSH
T14C217827F3CC8921CC95163A509D9C1176B282C7819FDFAFAFC0D211A5BF599CB71190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ypkfvlwq.n4s.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ypkfvlwq.n4s.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4916-1-0x000001A6BF580000-0x000001A6BF5A2000-memory.dmp

Download