Overview

overview

6

Static

static

1

Tweaks.bat

windows10-2004-x64

6

Tweaks.bat

windows11-ltsc_2024-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    36s
  • max time network
    36s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 01:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Tweaks.bat
  • Size 35KB
  • Sample260910-bjy6favyfv
  • SHA256 dd0d505674044d452042c1f8dc74ace456ad63fe6a6f3217420ab164a0396320
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
execution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Tweaks.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Windows\system32\net.exe
      net session
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5052
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 session
        3⤵
          PID:1976
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ps = Get-Content -Raw -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Tweaks.bat'; $idx = $ps.LastIndexOf('<#POWERSHELL#>'); if ($idx -lt 0) { Write-Host 'Fehler: PS-Block nicht gefunden.' -ForegroundColor Red; exit 1 }; $code = $ps.Substring($idx + 15).TrimStart(' ', [char]10, [char]13) -replace '(?m)^#requires.*\r?\n', ''; iex $code"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4300
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ps = Get-Content -Raw -LiteralPath 'C:\Users\Admin\AppData\Local\Temp\Tweaks.bat'; $idx = $ps.LastIndexOf('<#POWERSHELL#>'); if ($idx -lt 0) { Write-Host 'Fehler: PS-Block nicht gefunden.' -ForegroundColor Red; exit 1 }; $code = $ps.Substring($idx + 15).TrimStart(' ', [char]10, [char]13) -replace '(?m)^#requires.*\r?\n', ''; iex $code"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3024

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 3KB
          • SHA256 1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 9964fc622a1e5fdb8ebe56f56ebe5bd738bd8c18c1d6249188aede62d519835a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_ayiih0ro.nte.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ayiih0ro.nte.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/3024-16-0x00000178D65F0000-0x00000178D6600000-memory.dmp
          Download

          memory/3024-15-0x00000178D65F0000-0x00000178D6600000-memory.dmp
          Download

          memory/3024-26-0x00000178F2500000-0x00000178F271C000-memory.dmp
          Download

          memory/4300-1-0x000001D211470000-0x000001D211480000-memory.dmp
          Download

          memory/4300-0-0x000001D211470000-0x000001D211480000-memory.dmp
          Download

          memory/4300-2-0x000001D211480000-0x000001D2114A2000-memory.dmp
          Download

          memory/4300-10-0x000001D211470000-0x000001D211480000-memory.dmp
          Download

          memory/4300-11-0x000001D211470000-0x000001D211480000-memory.dmp
          Download