Analysis
- max time kernel
598s - max time network
599s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 11:03
Static task
static1
Behavioral task
behavioral1
Sample
№ 7093 від 22 вересня 2026 р.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
600 seconds
Behavioral task
behavioral2
Sample
№ 7093 від 22 вересня 2026 р.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
Behavioral task
behavioral3
Sample
№ 7093 від 22 вересня 2026 р..bat
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
600 seconds
General
- Target № 7093 від 22 вересня 2026 р..bat
- Size 4KB
- Sample260930-m5vwpade72
- SHA256 311d0910dc8bb69eae5514aff21d3411d62aa64e76de91cb916269fd1abd3901
- MD5 475e4d840fa0e674c50289793c569984
- SHA1 a5014e521ae3c0856e9f1212c6338d2af63cab03
- SHA512 73f0d6cac26377df5d8f5cf542457c4f98dd204d6e5f3a5606da749a7c94d1b52522e8425b2c23fc78993267198313406588aa7ee0e386160c27acce0868db35
- SSDEEP 96:qqc2g1oadjd6bVigiPiCn4mk6wb9Uoucpz1QB5eP5ZH0k7x1/tmxq:tc2grdqVz4GvWoucpz1QB5eP5ZH0k7Qq
- TLSH T13191A69DE21A4E0C148E1D31E0D562AAB9F6519153B0C539F2B49E603CD1FAAA0395FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 64 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 24 3492 powershell.exe 25 3492 powershell.exe 31 3492 powershell.exe 32 3492 powershell.exe 33 3492 powershell.exe 34 3492 powershell.exe 35 3492 powershell.exe 48 3492 powershell.exe 52 3492 powershell.exe 62 3492 powershell.exe 63 3492 powershell.exe 64 3492 powershell.exe 65 3492 powershell.exe 66 3492 powershell.exe 69 3492 powershell.exe 71 3492 powershell.exe 72 3492 powershell.exe 73 3492 powershell.exe 74 3492 powershell.exe 77 3492 powershell.exe 78 3492 powershell.exe 79 3492 powershell.exe 84 3492 powershell.exe 85 3492 powershell.exe 86 3492 powershell.exe 87 3492 powershell.exe 88 3492 powershell.exe 89 3492 powershell.exe 90 3492 powershell.exe 91 3492 powershell.exe 92 3492 powershell.exe 93 3492 powershell.exe 94 3492 powershell.exe 95 3492 powershell.exe 96 3492 powershell.exe 97 3492 powershell.exe 98 3492 powershell.exe 99 3492 powershell.exe 100 3492 powershell.exe 101 3492 powershell.exe 102 3492 powershell.exe 103 3492 powershell.exe 104 3492 powershell.exe 105 3492 powershell.exe 106 3492 powershell.exe 107 3492 powershell.exe 108 3492 powershell.exe 109 3492 powershell.exe 110 3492 powershell.exe 111 3492 powershell.exe 112 3492 powershell.exe 113 3492 powershell.exe 114 3492 powershell.exe 115 3492 powershell.exe 116 3492 powershell.exe 117 3492 powershell.exe 118 3492 powershell.exe 119 3492 powershell.exe 120 3492 powershell.exe 121 3492 powershell.exe 122 3492 powershell.exe 123 3492 powershell.exe 124 3492 powershell.exe 125 3492 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 3492 powershell.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ powershell.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4552 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe 3492 powershell.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3492 powershell.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4552 wrote to memory of 3404 4552 cmd.exe 86 PID 4552 wrote to memory of 3492 4552 cmd.exe 87
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\№ 7093 від 22 вересня 2026 р..bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo %Integrate% "2⤵PID:3404
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3492
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r0k3scte.qjx.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH