Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 07:36
General
- Target Счет на оплату (с печатью) № 540000015840 от 07.09.202687.bat
- Size 5KB
- Sample261002-jfc3ssxt7p
- SHA256 ceb2f87c77c15df3f39436c65f844260131324b04d221ff388ceb3c4cafa4838
Malware Config
Signatures
- Badlisted process makes network request 26 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Счет на оплату (с печатью) № 540000015840 от 07.09.202687.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo %predeluding% "2⤵
-
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_qtol4avt.z1t.ps1
memory/1924-15-0x0000000006230000-0x000000000624E000-memory.dmp
memory/1924-2-0x0000000074910000-0x00000000750CC000-memory.dmp
memory/1924-3-0x00000000054C0000-0x0000000005B0A000-memory.dmp
memory/1924-4-0x0000000074910000-0x00000000750CC000-memory.dmp
memory/1924-5-0x0000000005430000-0x0000000005452000-memory.dmp
memory/1924-7-0x0000000005CB0000-0x0000000005D16000-memory.dmp
memory/1924-1-0x0000000002990000-0x00000000029C6000-memory.dmp
memory/1924-6-0x0000000005C40000-0x0000000005CA6000-memory.dmp
memory/1924-0-0x0000000074922000-0x0000000074923000-memory.dmp
memory/1924-14-0x0000000005D20000-0x000000000607B000-memory.dmp
memory/1924-18-0x0000000074910000-0x00000000750CC000-memory.dmp
memory/1924-17-0x0000000007360000-0x00000000073A8000-memory.dmp
memory/1924-16-0x0000000006260000-0x00000000062AC000-memory.dmp
memory/1924-19-0x0000000007D40000-0x00000000083BC000-memory.dmp
memory/1924-20-0x0000000007700000-0x000000000771A000-memory.dmp
memory/1924-22-0x00000000077E0000-0x0000000007802000-memory.dmp
memory/1924-23-0x0000000008980000-0x0000000008F3A000-memory.dmp
memory/1924-21-0x0000000007840000-0x00000000078D6000-memory.dmp
memory/1924-24-0x0000000074922000-0x0000000074923000-memory.dmp
memory/1924-25-0x0000000074910000-0x00000000750CC000-memory.dmp