Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/09/2026, 12:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install-runner.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
install-runner.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
安装宏表格运行器.cmd
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
安装宏表格运行器.cmd
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
宏表格运行器.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
宏表格运行器.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 安装宏表格运行器.cmd
- Size 480B
- Sample260909-ppx28acb65
- SHA256 844953089bddff9bcc52ec5d98ac98d5db114a02f0185091cf4d383bf715894c
- MD5 b874fb716f933e31a43f7779e59411f3
- SHA1 f54de664e6638183790ce88adc22b9a15fe3187d
- SHA512 391f85da3fce21a5428e7916c78df0c391f42596d71f0c0288558a1fa4fd9fdc18f0704945e404594cd8c5b2f8cab74bd1549f1df9fdae411f138cde99f608e8
- TLSH T1A9F0AB87B324D279218B4FEE8D22B0903C18A08F02060DE6A08B0124370C7EEFBCA745
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
-
pid Process 3508 powershell.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3596 cmd.exe - Modifies registry class 56 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtuv\shell\open powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtsp powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtsp\ = "URL:宏表格" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtfn\ = "URL:宏表格" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtfn\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbthh powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtms\shell\open\command powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtbd\shell\open powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtuv powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtsum\shell powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtsum\shell\open powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtsum\ = "URL:宏表格" powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtid powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtid\shell\open powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtuv\shell\open\command powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtuv\ = "URL:宏表格" powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtfn\shell\open\command powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtfn\URL Protocol powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtsum\URL Protocol powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbthh\shell\open\command powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtms\ = "URL:宏表格" powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtid\shell\open\command powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtuv\URL Protocol powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtsp\shell\open powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtfn powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtsum powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtsum\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtid\ = "URL:宏表格" powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtbd\shell\open\command powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtbd\shell powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtuv\shell powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtuv\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtfn\shell powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtms\shell\open powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtms\URL Protocol powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtbd\ = "URL:宏表格" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtsp\URL Protocol powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtsum\shell\open\command powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbthh\shell powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbthh\shell\open powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbthh\URL Protocol powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbthh\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtms\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtid\URL Protocol powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtsp\shell powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtfn\shell\open powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtms powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtid\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtbd powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtbd\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtsp\shell\open\command powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtsp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbthh\ = "URL:宏表格" powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtms\shell powershell.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtid\shell powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\hbtbd\URL Protocol powershell.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3508 powershell.exe 3508 powershell.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3508 powershell.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3596 wrote to memory of 3508 3596 cmd.exe 86
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\安装宏表格运行器.cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\install-runner.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3508
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ykxyxpbh.nyd.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH