Analysis
- max time kernel
899s - max time network
898s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
№ 7093 від 22 вересня 2026 р.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
№ 7093 від 22 вересня 2026 р.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
№ 7093 від 22 вересня 2026 р..bat
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
900 seconds
General
- Target № 7093 від 22 вересня 2026 р..bat
- Size 4KB
- Sample260930-mxvkysyw2m
- SHA256 311d0910dc8bb69eae5514aff21d3411d62aa64e76de91cb916269fd1abd3901
- MD5 475e4d840fa0e674c50289793c569984
- SHA1 a5014e521ae3c0856e9f1212c6338d2af63cab03
- SHA512 73f0d6cac26377df5d8f5cf542457c4f98dd204d6e5f3a5606da749a7c94d1b52522e8425b2c23fc78993267198313406588aa7ee0e386160c27acce0868db35
- SSDEEP 96:qqc2g1oadjd6bVigiPiCn4mk6wb9Uoucpz1QB5eP5ZH0k7x1/tmxq:tc2grdqVz4GvWoucpz1QB5eP5ZH0k7Qq
- TLSH T13191A69DE21A4E0C148E1D31E0D562AAB9F6519153B0C539F2B49E603CD1FAAA0395FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 64 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 21 4848 powershell.exe 22 4848 powershell.exe 27 4848 powershell.exe 28 4848 powershell.exe 29 4848 powershell.exe 30 4848 powershell.exe 31 4848 powershell.exe 44 4848 powershell.exe 58 4848 powershell.exe 59 4848 powershell.exe 60 4848 powershell.exe 61 4848 powershell.exe 62 4848 powershell.exe 63 4848 powershell.exe 67 4848 powershell.exe 68 4848 powershell.exe 69 4848 powershell.exe 70 4848 powershell.exe 71 4848 powershell.exe 72 4848 powershell.exe 73 4848 powershell.exe 77 4848 powershell.exe 78 4848 powershell.exe 79 4848 powershell.exe 80 4848 powershell.exe 81 4848 powershell.exe 82 4848 powershell.exe 83 4848 powershell.exe 84 4848 powershell.exe 85 4848 powershell.exe 86 4848 powershell.exe 89 4848 powershell.exe 90 4848 powershell.exe 91 4848 powershell.exe 92 4848 powershell.exe 93 4848 powershell.exe 94 4848 powershell.exe 95 4848 powershell.exe 96 4848 powershell.exe 97 4848 powershell.exe 98 4848 powershell.exe 99 4848 powershell.exe 100 4848 powershell.exe 101 4848 powershell.exe 102 4848 powershell.exe 103 4848 powershell.exe 104 4848 powershell.exe 105 4848 powershell.exe 106 4848 powershell.exe 107 4848 powershell.exe 108 4848 powershell.exe 109 4848 powershell.exe 110 4848 powershell.exe 111 4848 powershell.exe 112 4848 powershell.exe 113 4848 powershell.exe 114 4848 powershell.exe 115 4848 powershell.exe 116 4848 powershell.exe 117 4848 powershell.exe 118 4848 powershell.exe 119 4848 powershell.exe 120 4848 powershell.exe 121 4848 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4848 powershell.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ powershell.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5044 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4848 powershell.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5044 wrote to memory of 4816 5044 cmd.exe 86 PID 5044 wrote to memory of 4848 5044 cmd.exe 87
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\№ 7093 від 22 вересня 2026 р..bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo %Integrate% "2⤵PID:4816
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4848
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4up10khi.3vt.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH