Analysis
- max time kernel
599s - max time network
600s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 11:03
Static task
static1
Behavioral task
behavioral1
Sample
№ 7093 від 22 вересня 2026 р.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
600 seconds
Behavioral task
behavioral2
Sample
№ 7093 від 22 вересня 2026 р.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
Behavioral task
behavioral3
Sample
№ 7093 від 22 вересня 2026 р..bat
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
600 seconds
General
- Target № 7093 від 22 вересня 2026 р..bat
- Size 4KB
- Sample260930-m5vwpade72
- SHA256 311d0910dc8bb69eae5514aff21d3411d62aa64e76de91cb916269fd1abd3901
- MD5 475e4d840fa0e674c50289793c569984
- SHA1 a5014e521ae3c0856e9f1212c6338d2af63cab03
- SHA512 73f0d6cac26377df5d8f5cf542457c4f98dd204d6e5f3a5606da749a7c94d1b52522e8425b2c23fc78993267198313406588aa7ee0e386160c27acce0868db35
- SSDEEP 96:qqc2g1oadjd6bVigiPiCn4mk6wb9Uoucpz1QB5eP5ZH0k7x1/tmxq:tc2grdqVz4GvWoucpz1QB5eP5ZH0k7Qq
- TLSH T13191A69DE21A4E0C148E1D31E0D562AAB9F6519153B0C539F2B49E603CD1FAAA0395FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 64 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 6036 powershell.exe 3 6036 powershell.exe 7 6036 powershell.exe 9 6036 powershell.exe 10 6036 powershell.exe 11 6036 powershell.exe 12 6036 powershell.exe 13 6036 powershell.exe 14 6036 powershell.exe 15 6036 powershell.exe 16 6036 powershell.exe 17 6036 powershell.exe 18 6036 powershell.exe 19 6036 powershell.exe 20 6036 powershell.exe 21 6036 powershell.exe 22 6036 powershell.exe 23 6036 powershell.exe 31 6036 powershell.exe 32 6036 powershell.exe 33 6036 powershell.exe 34 6036 powershell.exe 35 6036 powershell.exe 36 6036 powershell.exe 37 6036 powershell.exe 38 6036 powershell.exe 39 6036 powershell.exe 40 6036 powershell.exe 42 6036 powershell.exe 43 6036 powershell.exe 44 6036 powershell.exe 45 6036 powershell.exe 46 6036 powershell.exe 47 6036 powershell.exe 48 6036 powershell.exe 49 6036 powershell.exe 50 6036 powershell.exe 51 6036 powershell.exe 52 6036 powershell.exe 53 6036 powershell.exe 54 6036 powershell.exe 55 6036 powershell.exe 56 6036 powershell.exe 57 6036 powershell.exe 58 6036 powershell.exe 59 6036 powershell.exe 60 6036 powershell.exe 61 6036 powershell.exe 62 6036 powershell.exe 63 6036 powershell.exe 64 6036 powershell.exe 74 6036 powershell.exe 74 6036 powershell.exe 76 6036 powershell.exe 77 6036 powershell.exe 78 6036 powershell.exe 79 6036 powershell.exe 81 6036 powershell.exe 82 6036 powershell.exe 83 6036 powershell.exe 84 6036 powershell.exe 85 6036 powershell.exe 86 6036 powershell.exe 87 6036 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 6036 powershell.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ powershell.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5708 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe 6036 powershell.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 6036 powershell.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5708 wrote to memory of 3360 5708 cmd.exe 92 PID 5708 wrote to memory of 6036 5708 cmd.exe 93
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\№ 7093 від 22 вересня 2026 р..bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo %Integrate% "2⤵PID:3360
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6036
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1372