7546010b986d950474ebf1a16ea0cf3717758e0ae8660607f49800958da780c6

Resubmissions

31/08/2026, 16:07

260831-tk28layscx3

31/08/2026, 16:02

260831-tg24esvhka3

31/08/2026, 15:59

260831-tfgfbscn3x3

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.bat
Size 5KB
Sample260831-tk28layscx
SHA256 7546010b986d950474ebf1a16ea0cf3717758e0ae8660607f49800958da780c6
MD5 c199907162f8b36ef75bde96724247b8
SHA1 9cb6e77c7ef3087c04c901cbfa45aa99c65cb839
SHA512 d3824a48116fbd2a723a33cc46f4b75410313b3e5fa1f14960ef25397144ea48c87a1d42ae46c8e8b6571ddf9967378699ce89e3ca6a35dd5afff9a4d3f1ef68
SSDEEP 96:LuRLACWQJVTDeWpT4xVv36Z0ueM6yhaGxP9gDQ/eXnY:jCJVTyi6y0uenMaGx1gDQ2XY
TLSH
T113B18674731BE85844610F2B9CBA90A4F83503736656AD48F0AF82B5AF8F7D0737E548
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4552	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2480	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4552	powershell.exe
4552	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4552	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 4692	2480	cmd.exe	90
PID 2480 wrote to memory of 3348	2480	cmd.exe	91
PID 2480 wrote to memory of 4552	2480	cmd.exe	92
PID 4552 wrote to memory of 2876	4552	powershell.exe	93
PID 2876 wrote to memory of 5744	2876	csc.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Accessibility" /v "CursorBaseSize" /t REG_DWORD /d 16 /f
  2⤵
  PID:4692
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "" /t REG_SZ /d "Windows Default" /f
  2⤵
  PID:3348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$sig = '[DllImport(\"user32.dll\")] public static extern bool SystemParametersInfo(uint uAction, uint uParam, string lpvParam, uint fuWinIni);'; $type = Add-Type -MemberDefinition $sig -Name 'Win32' -PassThru; $type::SystemParametersInfo(0x0057, 0, $null, 0x02)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xsystqtz\xsystqtz.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES323.tmp" "c:\Users\Admin\AppData\Local\Temp\xsystqtz\CSCB49E4829BE54487BD6C46CF9E17CBD1.TMP"
      4⤵
      PID:5744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES323.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES323.tmp
Size 1KB
SHA256 4b0959975d8afe5be2afe967ca32727ec44238ec0b28db45ca28ad74fac4cf0d
MD5 a0ea426bdaac64094930734469a5e049
SHA1 3ae3d24ba87acad3e34fbc086a4c6e2b372e19d8
SHA512 bbeca576c7a4933ca16a3abc58e9f3475b5d2cf7dd869ba78205fcd9321718aa45bffbe2c32dfd5cbd34e6d84a264ee8a38d3808289a44e4ed800ba856e2849e
TLSH
T1C321AF0697E9870EF4734B3179FA532F96B5FD59EFA2E35A8544122C2C41104EEB0B72
MD5 SHA1 SHA512 TLSH

Submit Download

xsystqtz.dll

Path C:\Users\Admin\AppData\Local\Temp\xsystqtz\xsystqtz.dll
Size 3KB
SHA256 db6a1ea794cf1697c462884ee59e12f373b9daa2bcaafe0d0b8c038da4a4d50f
MD5 975b78e6aeeda0f1237d998b9f793859
SHA1 766d0bca8826e386157f52d653d730769ebc16b7
SHA512 0a9c40974abbaf6a15ca36397dc6112391fd17f5a8c780767a93b52c80b8bb42f25ed63141a3cbadb1596ed88ef5979f6f235f8faa131d17fa28a2eafabe9931
TLSH
T10D51DF1AA7E8466BE4770B35ADF3872627B4F8509FB3E35E59C40218AC216585D32FB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB49E4829BE54487BD6C46CF9E17CBD1.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xsystqtz\CSCB49E4829BE54487BD6C46CF9E17CBD1.TMP
Size 652B
SHA256 86d3715574bd178e81fe347af8fccc0efbc265505c9275d775b629191dbbee39
MD5 65fd633daa11699eadae7f164ac11457
SHA1 8b9cb5f5da7b84c4b9617c97f73d9bf42b88cbcc
SHA512 1ea6c0ce39be3c37b912ae437da4debe1c0c01ad1fd44b3628fb71001c79a39a5badeaef62073293ee219e129be99b8ae2468fa7da352d96fda444924d42e494
TLSH
T164F03A0A63F8420AF4F34F30B9F6436391A8BC64DE32A3ED5550131D2865510D972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

xsystqtz.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xsystqtz\xsystqtz.0.cs
Size 301B
SHA256 ed2377f587cd2f6284ab8b15579ce71517ad76a088b2d4cef93b6f53e964fbd4
MD5 6f0ab09e2b00a957d7e97c5e77166ad5
SHA1 b4ab0bc775b5a9f207a25c9c7bc3bd30ec5e1a9c
SHA512 be2d2ba806fb8779b9bf8aa27b9c38c5bde3c357e76ed0f30900c47792e01057ff64874b79f8b25d9ed0bb63d89d5f62845cc808ecd288fff72ceda4691ec9b7
TLSH
T121E07D2477B39A6540C70C0B8CD1F074E732812B26DF6A16B8EC4100CF8B41C4232B19
MD5 SHA1 SHA512 TLSH

Submit Download

xsystqtz.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xsystqtz\xsystqtz.cmdline
Size 369B
SHA256 fcdea9ba7846865c5014b21e36dcf250a16d023ec5c3b2536a1bfd8baa194161
MD5 0b5a13448c7a4a23d41b32b6a412c46c
SHA1 495a03daa98f94bd9ef1246c61b78e5186ff8fda
SHA512 4c7ad253ddbd190d48a8b90f5935b3840bbf738bbe67aa90be86ddd24855266c6a55f881e97bb4d60eddd62e96697d0f4b8ceb0654026dae8bcbb86c573f8af0
TLSH
T1F8E0D82EB257C67D55DD201F216BC9FC8AB2164729427FC85190485DD0170456FD1BE6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4552-19-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4552-4-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4552-9-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4552-10-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4552-7-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4552-0-0x00007FF844B9F000-0x00007FF844BA0000-memory.dmp

Download

memory/4552-8-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4552-20-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4552-16-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4552-5-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4552-6-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4552-26-0x000002347DFA0000-0x000002347DFA8000-memory.dmp

Download

memory/4552-3-0x000002347DFC0000-0x000002347DFE2000-memory.dmp

Download

memory/4552-28-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download

memory/4552-29-0x00007FF844A10000-0x00007FF8453B4000-memory.dmp

Download