9a7f17d9fc4a5b3b6aa77e55b02af758612757528526e7c944471d0c2c850bab

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FPSDoctor_OPTI_EXPRESS/Scripts_BoostMode/FPSDoctor_Disable_Hibernation_Advanced.bat
Size 109B
Sample260824-v71tqa1fkd
SHA256 9a7f17d9fc4a5b3b6aa77e55b02af758612757528526e7c944471d0c2c850bab
MD5 e78ded0232eb6c98ef5f1e213630e1f5
SHA1 a8de3a3269290c85d5afa9c787da9b4159a01b2c
SHA512 f9362471b49d239512ec2cacbb7faf8e074113a5937dc34f9ac0d004c14a498f4732489a1605274c35ae104c6367d77e857fdb35c55400b4f79f405629e69e3f
TLSH
T1ECB092B65048313B04C7C176384961833DAA268311108DA7F99AA2658E409FDAB8A632
MD5 SHA1 SHA512 TLSH

Score

6^/10

execution persistence

Malware Config

Signatures

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3488	powercfg.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4652	cmd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3488	powercfg.exe
Token: SeCreatePagefilePrivilege	3488	powercfg.exe
Token: SeShutdownPrivilege	3488	powercfg.exe
Token: SeCreatePagefilePrivilege	3488	powercfg.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 3488	4652	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FPSDoctor_OPTI_EXPRESS\Scripts_BoostMode\FPSDoctor_Disable_Hibernation_Advanced.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\system32\powercfg.exe
  powercfg -h off
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads