e305b1892a0cc85ebe4943f4780c30a1cabfe7f94895c8f087773053eca7fd3e

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/10/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purchase_Order_PO23342.bat
Size 1.8MB
Sample261021-vm34caes91
SHA256 e305b1892a0cc85ebe4943f4780c30a1cabfe7f94895c8f087773053eca7fd3e
MD5 d2298432c78cd9e6ebf3cd0b0b992bea
SHA1 328527da482eed85afe5fad5be570968c46396f0
SHA512 33c1dc8f1fb4da6d6bde45f4a09292bb824e7eb6630a2970f1d879fd580bd4d9c70c892788a2f63d064ebe8712d4cda0e618fa18c38b48e2edfde7b4b958e0e2
SSDEEP 24576:abF116BQVy8AogacpY3lpJaObNtMFWvnmUaF5Oq345hATgV4CKEw6oydOra6:abfVBgacpcnx88hATSTKupOl
TLSH
T1768502322F5E5FAF6E446359D27822173E98E38FC9C4E169D6BDBC473BF1424188A064
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Environment\UserInitMprLogonScript = "L╒▒ß₧ùß₧ä╒Éß₧ë╒æα«Üα╜₧α╜àKß₧Äα«çα╜ë╓àßï¿ßìÇß₧Äß₧öα«▒ß₧å╒¡tß₧ü╒ºDEST_PATH /f >nul 2>&1"	reg.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4260	cscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4932	cmd.exe
3520	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4940	4932	cmd.exe	90
PID 4932 wrote to memory of 4352	4932	cmd.exe	91
PID 4932 wrote to memory of 4500	4932	cmd.exe	92
PID 4932 wrote to memory of 4260	4932	cmd.exe	93
PID 4260 wrote to memory of 3520	4260	cscript.exe	95
PID 3520 wrote to memory of 4780	3520	cmd.exe	97
PID 3520 wrote to memory of 1172	3520	cmd.exe	98
PID 3520 wrote to memory of 1688	3520	cmd.exe	99

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Purchase_Order_PO23342.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\system32\reg.exe
  reg query "HKCU\Environment" /v UserInitMprLogonScript
  2⤵
  PID:4940
- C:\Windows\system32\find.exe
  find /i "C:\Users\Admin\AppData\Roaming\SystemUpdate\SystemUpdate.bat"
  2⤵
  PID:4352
- C:\Windows\system32\reg.exe
  reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d L╒▒ß₧ùß₧ä╒Éß₧ë╒æα«Üα╜₧α╜àKß₧Äα«çα╜ë╓àßï¿ßìÇß₧Äß₧öα«▒ß₧å╒¡tß₧ü╒ºDEST_PATH" /f >nul 2>&1
  2⤵
  - Registers new Windows logon scripts automatically executed at logon.
  PID:4500
- C:\Windows\system32\cscript.exe
  cscript.exe //nologo "C:\Users\Admin\AppData\Local\Temp\~run.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\Purchase_Order_PO23342.bat" hidden
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3520
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Environment" /v UserInitMprLogonScript
      4⤵
      PID:4780
  - - C:\Windows\system32\find.exe
      find /i "C:\Users\Admin\AppData\Roaming\SystemUpdate\SystemUpdate.bat"
      4⤵
      PID:1172
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Environment" /v UserInitMprLogonScript /t REG_SZ /d L╒▒ß₧ùß₧ä╒Éß₧ë╒æα«Üα╜₧α╜àKß₧Äα«çα╜ë╓àßï¿ßìÇß₧Äß₧öα«▒ß₧å╒¡tß₧ü╒ºDEST_PATH" /f >nul 2>&1
      4⤵
      PID:1688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~run.vbs

Path C:\Users\Admin\AppData\Local\Temp\~run.vbs
Size 127B
SHA256 5617ee760b8595b7d4f8b3e1b77f006cc847b24b3dd22e552151d6f2c705a118
MD5 a5749d25fb66df8cbd8c50ec5721abd0
SHA1 e3b088fb2403614214d5313394651c9791ff727c
SHA512 d90991cfcb7efd1443678cf6f4b4b54208d04a8aa1032e7a758d675ae9974fb38da77f1a2bee0d3ab869b30f4a5cf2c24603134ff5978df404aad4f1773407cd
TLSH
T103B02B12620CC13C000281960530D55C84D1C844162467050710CD0C50768C065CB901
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads