Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/09/2026, 12:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
install-runner.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
install-runner.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
安装宏表格运行器.cmd
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
安装宏表格运行器.cmd
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
宏表格运行器.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
宏表格运行器.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 安装宏表格运行器.cmd
- Size 480B
- Sample260909-ppx28acb65
- SHA256 844953089bddff9bcc52ec5d98ac98d5db114a02f0185091cf4d383bf715894c
- MD5 b874fb716f933e31a43f7779e59411f3
- SHA1 f54de664e6638183790ce88adc22b9a15fe3187d
- SHA512 391f85da3fce21a5428e7916c78df0c391f42596d71f0c0288558a1fa4fd9fdc18f0704945e404594cd8c5b2f8cab74bd1549f1df9fdae411f138cde99f608e8
- TLSH T1A9F0AB87B324D279218B4FEE8D22B0903C18A08F02060DE6A08B0124370C7EEFBCA745
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
-
pid Process 4964 powershell.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5980 cmd.exe - Modifies registry class 56 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtuv\ = "URL:宏表格" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtsum\URL Protocol powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtsum\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtms\shell powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtms\shell\open powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtbd\shell powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtbd\ = "URL:宏表格" powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtsp\shell\open powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbthh\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtms powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtbd\URL Protocol powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtuv\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtsum\shell\open powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtms\URL Protocol powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtid powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtid\shell powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtsum\ = "URL:宏表格" powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtsp powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtsp\ = "URL:宏表格" powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtfn\shell\open\command powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtfn\shell\open powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtfn\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtsum powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbthh\shell powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtuv\shell\open\command powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtfn\shell powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtsum\shell\open\command powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbthh\shell\open\command powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbthh\ = "URL:宏表格" powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtms\shell\open\command powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtid\shell\open powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtid\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtsp\shell powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtsp\URL Protocol powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtfn powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtfn\ = "URL:宏表格" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtms\ = "URL:宏表格" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtid\ = "URL:宏表格" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtid\URL Protocol powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtbd\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtuv\shell powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtsum\shell powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbthh powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbthh\shell\open powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbthh\URL Protocol powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtid\shell\open\command powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtbd powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtbd\shell\open powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtsp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtuv powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtuv\URL Protocol powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtsp\shell\open\command powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtfn\URL Protocol powershell.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtms\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\宏表格\\宏表格运行器.exe\" \"%1\"" powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtbd\shell\open\command powershell.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\hbtuv\shell\open powershell.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4964 powershell.exe 4964 powershell.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4964 powershell.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5980 wrote to memory of 4964 5980 cmd.exe 90
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\安装宏表格运行器.cmd"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\install-runner.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4964
-