Analysis
- max time kernel
899s - max time network
901s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
№ 7093 від 22 вересня 2026 р.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
№ 7093 від 22 вересня 2026 р.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
№ 7093 від 22 вересня 2026 р..bat
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
900 seconds
General
- Target № 7093 від 22 вересня 2026 р..bat
- Size 4KB
- Sample260930-mxvkysyw2m
- SHA256 311d0910dc8bb69eae5514aff21d3411d62aa64e76de91cb916269fd1abd3901
- MD5 475e4d840fa0e674c50289793c569984
- SHA1 a5014e521ae3c0856e9f1212c6338d2af63cab03
- SHA512 73f0d6cac26377df5d8f5cf542457c4f98dd204d6e5f3a5606da749a7c94d1b52522e8425b2c23fc78993267198313406588aa7ee0e386160c27acce0868db35
- SSDEEP 96:qqc2g1oadjd6bVigiPiCn4mk6wb9Uoucpz1QB5eP5ZH0k7x1/tmxq:tc2grdqVz4GvWoucpz1QB5eP5ZH0k7Qq
- TLSH T13191A69DE21A4E0C148E1D31E0D562AAB9F6519153B0C539F2B49E603CD1FAAA0395FF
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Badlisted process makes network request 64 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 4268 powershell.exe 8 4268 powershell.exe 9 4268 powershell.exe 11 4268 powershell.exe 12 4268 powershell.exe 13 4268 powershell.exe 14 4268 powershell.exe 15 4268 powershell.exe 16 4268 powershell.exe 17 4268 powershell.exe 19 4268 powershell.exe 20 4268 powershell.exe 21 4268 powershell.exe 22 4268 powershell.exe 23 4268 powershell.exe 24 4268 powershell.exe 25 4268 powershell.exe 26 4268 powershell.exe 27 4268 powershell.exe 28 4268 powershell.exe 29 4268 powershell.exe 30 4268 powershell.exe 31 4268 powershell.exe 32 4268 powershell.exe 33 4268 powershell.exe 34 4268 powershell.exe 35 4268 powershell.exe 36 4268 powershell.exe 37 4268 powershell.exe 38 4268 powershell.exe 39 4268 powershell.exe 40 4268 powershell.exe 41 4268 powershell.exe 42 4268 powershell.exe 43 4268 powershell.exe 44 4268 powershell.exe 45 4268 powershell.exe 46 4268 powershell.exe 47 4268 powershell.exe 48 4268 powershell.exe 49 4268 powershell.exe 50 4268 powershell.exe 51 4268 powershell.exe 52 4268 powershell.exe 53 4268 powershell.exe 54 4268 powershell.exe 55 4268 powershell.exe 56 4268 powershell.exe 57 4268 powershell.exe 58 4268 powershell.exe 62 4268 powershell.exe 72 4268 powershell.exe 72 4268 powershell.exe 74 4268 powershell.exe 75 4268 powershell.exe 76 4268 powershell.exe 77 4268 powershell.exe 79 4268 powershell.exe 80 4268 powershell.exe 81 4268 powershell.exe 82 4268 powershell.exe 83 4268 powershell.exe 84 4268 powershell.exe 85 4268 powershell.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4268 powershell.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ powershell.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5312 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe 4268 powershell.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4268 powershell.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5312 wrote to memory of 5352 5312 cmd.exe 89 PID 5312 wrote to memory of 4268 5312 cmd.exe 90
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\№ 7093 від 22 вересня 2026 р..bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo %Integrate% "2⤵PID:5352
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4268
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1040
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:1708