e305b1892a0cc85ebe4943f4780c30a1cabfe7f94895c8f087773053eca7fd3e

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/10/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purchase_Order_PO23342.bat
Size 1.8MB
Sample261021-vm34caes91
SHA256 e305b1892a0cc85ebe4943f4780c30a1cabfe7f94895c8f087773053eca7fd3e
MD5 d2298432c78cd9e6ebf3cd0b0b992bea
SHA1 328527da482eed85afe5fad5be570968c46396f0
SHA512 33c1dc8f1fb4da6d6bde45f4a09292bb824e7eb6630a2970f1d879fd580bd4d9c70c892788a2f63d064ebe8712d4cda0e618fa18c38b48e2edfde7b4b958e0e2
SSDEEP 24576:abF116BQVy8AogacpY3lpJaObNtMFWvnmUaF5Oq345hATgV4CKEw6oydOra6:abfVBgacpcnx88hATSTKupOl
TLSH
T1768502322F5E5FAF6E446359D27822173E98E38FC9C4E169D6BDBC473BF1424188A064
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	cscript.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Environment\UserInitMprLogonScript = "L╒▒ß₧ùß₧ä╒Éß₧ë╒æα«Üα╜₧α╜àKß₧Äα«çα╜ë╓àßï¿ßìÇß₧Äß₧öα«▒ß₧å╒¡tß₧ü╒ºDEST_PATH /f >nul 2>&1"	reg.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
968	cscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
868	cmd.exe
556	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 2228	868	cmd.exe	88
PID 868 wrote to memory of 2980	868	cmd.exe	89
PID 868 wrote to memory of 4508	868	cmd.exe	90
PID 868 wrote to memory of 968	868	cmd.exe	91
PID 968 wrote to memory of 556	968	cscript.exe	92
PID 556 wrote to memory of 2524	556	cmd.exe	94
PID 556 wrote to memory of 2568	556	cmd.exe	95
PID 556 wrote to memory of 1756	556	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Purchase_Order_PO23342.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\system32\reg.exe
  reg query "HKCU\Environment" /v UserInitMprLogonScript
  2⤵
  PID:2228
- C:\Windows\system32\find.exe
  find /i "C:\Users\Admin\AppData\Roaming\SystemUpdate\SystemUpdate.bat"
  2⤵
  PID:2980
- C:\Windows\system32\reg.exe
  reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d L╒▒ß₧ùß₧ä╒Éß₧ë╒æα«Üα╜₧α╜àKß₧Äα«çα╜ë╓àßï¿ßìÇß₧Äß₧öα«▒ß₧å╒¡tß₧ü╒ºDEST_PATH" /f >nul 2>&1
  2⤵
  - Registers new Windows logon scripts automatically executed at logon.
  PID:4508
- C:\Windows\system32\cscript.exe
  cscript.exe //nologo "C:\Users\Admin\AppData\Local\Temp\~run.vbs"
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\Purchase_Order_PO23342.bat" hidden
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Environment" /v UserInitMprLogonScript
      4⤵
      PID:2524
  - - C:\Windows\system32\find.exe
      find /i "C:\Users\Admin\AppData\Roaming\SystemUpdate\SystemUpdate.bat"
      4⤵
      PID:2568
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d L╒▒ß₧ùß₧ä╒Éß₧ë╒æα«Üα╜₧α╜àKß₧Äα«çα╜ë╓àßï¿ßìÇß₧Äß₧öα«▒ß₧å╒¡tß₧ü╒ºDEST_PATH" /f >nul 2>&1
      4⤵
      PID:1756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~run.vbs

Path C:\Users\Admin\AppData\Local\Temp\~run.vbs
Size 127B
SHA256 5617ee760b8595b7d4f8b3e1b77f006cc847b24b3dd22e552151d6f2c705a118
MD5 a5749d25fb66df8cbd8c50ec5721abd0
SHA1 e3b088fb2403614214d5313394651c9791ff727c
SHA512 d90991cfcb7efd1443678cf6f4b4b54208d04a8aa1032e7a758d675ae9974fb38da77f1a2bee0d3ab869b30f4a5cf2c24603134ff5978df404aad4f1773407cd
TLSH
T103B02B12620CC13C000281960530D55C84D1C844162467050710CD0C50768C065CB901
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads