d44147b2130619f5e19a34470d73646a085b843ecdb1947ea9346b05fd9cdc15

Analysis

max time kernel
149s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.bat
Size 4KB
Sample260831-tdetqavgla
SHA256 d44147b2130619f5e19a34470d73646a085b843ecdb1947ea9346b05fd9cdc15
MD5 b01549b5c7d1bb3f683e55dd99ae2aa3
SHA1 db9146833253aaf80cd0d856f08732b573dbccf7
SHA512 6635ca4520298ba31883f7a2814bd915423352aedbccab03c1eb13b1cd3d64c5638812d1e0b3fefc3b03a163f4b233f40d15a130a2c4b973dbf6b673ec820948
SSDEEP 96:LuRLAJqQAOtaZhGKH3EbCKoBjYzOFOdQBK45nY:jBAOYX7HNaOFOWU45Y
TLSH
T12EA1B770731BAC1C8471492B98DEB1A0F9395233219BA648F05CCA65EF5FB518377E9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3316	powershell.exe
2724	powershell.exe
2452	powershell.exe
260	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4480	cmd.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3316	powershell.exe
3316	powershell.exe
2452	powershell.exe
2724	powershell.exe
2452	powershell.exe
2724	powershell.exe
260	powershell.exe
260	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3316	powershell.exe
Token: SeDebugPrivilege	2452	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	260	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 2604	4480	cmd.exe	90
PID 4480 wrote to memory of 4308	4480	cmd.exe	91
PID 4480 wrote to memory of 3316	4480	cmd.exe	92
PID 3316 wrote to memory of 484	3316	powershell.exe	93
PID 484 wrote to memory of 4856	484	csc.exe	94
PID 4480 wrote to memory of 2724	4480	cmd.exe	95
PID 4480 wrote to memory of 2452	4480	cmd.exe	96
PID 4480 wrote to memory of 260	4480	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Accessibility" /v "CursorBaseSize" /t REG_DWORD /d 16 /f
  2⤵
  PID:2604
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "" /t REG_SZ /d "Windows Default" /f
  2⤵
  PID:4308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$sig = '[DllImport(\"user32.dll\")] public static extern bool SystemParametersInfo(uint uAction, uint uParam, string lpvParam, uint fuWinIni);'; $type = Add-Type -MemberDefinition $sig -Name 'Win32' -PassThru; $type::SystemParametersInfo(0x0057, 0, $null, 0x02)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4soaasmz\4soaasmz.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:484
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3EA5.tmp" "c:\Users\Admin\AppData\Local\Temp\4soaasmz\CSCF4064694ADC544C5B093FC6D57F776A6.TMP"
      4⤵
      PID:4856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 30968549dad31e60a30bcfafe0bc33e745f34f538841d09b91306ea455eee958
MD5 f623929fbf303a8b140095d9568ac988
SHA1 8c39ae9758011dabd587c6f4ae7a63b11343106d
SHA512 a75f1a30783549196144f66a43688f6eda179859f804ced37e03a1ee4d445e87466f1f43b6288dfe775833f9cda36e23ce2796a771515202691ae59162d6efe6
TLSH
T1F7215733F3CC8624DC9A413650CEAC1136B687DB409ECE6BBB84D558B42F289DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
MD5 ccd060f9f366be151fe026216473d89d
SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
MD5 SHA1 SHA512

Submit Download

4soaasmz.dll

Path C:\Users\Admin\AppData\Local\Temp\4soaasmz\4soaasmz.dll
Size 3KB
SHA256 c5cee65c9940db3315401e9c03dc17210eb279b90930f2dbca669241b7950778
MD5 cd288ce41c201fb6ee2b6e9ecd66efd9
SHA1 537bad52799abeb3a4dd34f9365a1f333ed55a2b
SHA512 4a817164a1115cc5a8175b631b06c9115cfb99ff0548033d802618c3c5539fb33a83b095c3ef149cebfca65dd36e250d230726e9a8ede4abbe9453bae2e82fd9
TLSH
T16C51E116A3E8466BE4774B35ADF3436667B4F8509FB3D72E58C00228AC217585D32FB0
MD5 SHA1 SHA512 TLSH

Submit Download

RES3EA5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3EA5.tmp
Size 1KB
SHA256 dadecaff7680501dc8ddac40b8983c5624974a02500e77e5cca97434c1dec931
MD5 e294afe9f3064e6cb39fc7d93964d7f0
SHA1 f80118346c3137e7273c03c0ea03579bd16db31d
SHA512 070cd8227e931e9bf42fd527a2fa146764d526275034b795cea604022e331897141038a110d729a831f92634b2b1925e1cd7cad8be8f3eb1ea228e2b2d24b71f
TLSH
T18C21CC4583ED4B0FF0739B3169F6132F9274FD55EFA2A75A854042281C11504EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ju522gan.bq4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ju522gan.bq4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

4soaasmz.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\4soaasmz\4soaasmz.0.cs
Size 301B
SHA256 ed2377f587cd2f6284ab8b15579ce71517ad76a088b2d4cef93b6f53e964fbd4
MD5 6f0ab09e2b00a957d7e97c5e77166ad5
SHA1 b4ab0bc775b5a9f207a25c9c7bc3bd30ec5e1a9c
SHA512 be2d2ba806fb8779b9bf8aa27b9c38c5bde3c357e76ed0f30900c47792e01057ff64874b79f8b25d9ed0bb63d89d5f62845cc808ecd288fff72ceda4691ec9b7
TLSH
T121E07D2477B39A6540C70C0B8CD1F074E732812B26DF6A16B8EC4100CF8B41C4232B19
MD5 SHA1 SHA512 TLSH

Submit Download

4soaasmz.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\4soaasmz\4soaasmz.cmdline
Size 369B
SHA256 5a2ec5d5e035c3ee8e3809fc90f73537c2b79f4d9ca5965c9354327c2199c3a1
MD5 f0f88f8dd5527a290deba90d5a3ef4b6
SHA1 a118f35895225bcc097aaa394fe9665befa6f764
SHA512 06bbec8fe18f7bfc53aa04e5c222ca05afa7e4b2c0e94f25b6c0f59e833d42e24f3ad1720f59fe50d90c7f541625135fbec9d67aebf254f5f2e1a96b49000b6e
TLSH
T18EE06F7A534FC37D11ED100B2ABBC4EC82B7068339A83F849040889DE0778082BD2FA1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF4064694ADC544C5B093FC6D57F776A6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\4soaasmz\CSCF4064694ADC544C5B093FC6D57F776A6.TMP
Size 652B
SHA256 e8b7fe67675722c5ec01a0763d12600aca52e423f1c6b9e4856a7380aaed7b88
MD5 f958f259cbb717197925616520ea9b56
SHA1 f872d45a60b91dd6c750841482e65f8f80986d5e
SHA512 d12d293bfc9511e5aad557dfe893a2c261dbd2b178cef4769a9a6aba895c71e1ce0b2bcddeaa391dee94518d36054f425380acb85590a8d6631e1a4e5ec6c166
TLSH
T1F3F05E49A3F8120EF0F39F31BDF6436391A8BC65DE32A3ED244003192864A10C972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3316-6-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/3316-20-0x0000022A75A60000-0x0000022A75A68000-memory.dmp

Download

memory/3316-12-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/3316-23-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/3316-0-0x00007FFC4403F000-0x00007FFC44040000-memory.dmp

Download

memory/3316-22-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/3316-5-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/3316-4-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/3316-3-0x0000022A75A70000-0x0000022A75A92000-memory.dmp

Download