51123b4998b76fdfa04500d3d8979860e6c5927b49ff05b517f3705fb992efdf

Analysis

user interaction
yes
max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FallenOptimizerv2.bat
Size 50KB
Sample261023-292mcsvz7r
SHA256 51123b4998b76fdfa04500d3d8979860e6c5927b49ff05b517f3705fb992efdf
MD5 f4e7267aa46852ad0630ca54bb76011a
SHA1 91e59ccd882263bfe26c36e049a0c1acfd5a79d4
SHA512 7488f7d7d0421ce3bb4557be2c9197f324127111d7b5dc2d67b74857331e1ebbb03b5075c4379ad219478a5aeed9d1780d446ed484142c6b20fbe934434001c2
SSDEEP 768:vmkFEMgjE9jV8AORKklpu/+b/BmpHVWboL3XhlJw:+ygmV3OTLu/+t9oLBl+
TLSH
T129337232AD86CC2632F2CB3ED21A6534FB2473873A10555471ECB05D2BEDBA652BC176
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4872	powershell.exe
2688	powershell.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
248	powercfg.exe
4748	powercfg.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4872	powershell.exe
2688	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4688	cmd.exe
1676	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4872	powershell.exe
4872	powershell.exe
2688	powershell.exe
2688	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeShutdownPrivilege	248	powercfg.exe
Token: SeCreatePagefilePrivilege	248	powercfg.exe
Token: SeShutdownPrivilege	4748	powercfg.exe
Token: SeCreatePagefilePrivilege	4748	powercfg.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4564	4688	cmd.exe	90
PID 4688 wrote to memory of 2224	4688	cmd.exe	91
PID 4688 wrote to memory of 5800	4688	cmd.exe	92
PID 4688 wrote to memory of 1676	4688	cmd.exe	93
PID 1676 wrote to memory of 2584	1676	cmd.exe	94
PID 1676 wrote to memory of 5088	1676	cmd.exe	95
PID 4688 wrote to memory of 4872	4688	cmd.exe	96
PID 4688 wrote to memory of 2688	4688	cmd.exe	97
PID 4688 wrote to memory of 248	4688	cmd.exe	98
PID 4688 wrote to memory of 4748	4688	cmd.exe	99

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FallenOptimizerv2.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:4564
- C:\Windows\system32\reg.exe
  reg add "HKCU\Console" /v VirtualTerminalLevel /t REG_DWORD /d 1 /f
  2⤵
  PID:2224
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:2584
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$t = @'" + [Environment]::NewLine + "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8" + [Environment]::NewLine + "$ESC = [char]27" + [Environment]::NewLine + "$cRst = ""$ESC[0m""" + [Environment]::NewLine + "$cDim = ""$ESC[38;2;139;139;158m""" + [Environment]::NewLine + "$cOk = ""$ESC[38;2;34;197;94m""" + [Environment]::NewLine + "$cWrn = ""$ESC[38;2;245;158;11m""" + [Environment]::NewLine + "$cBad = ""$ESC[38;2;239;68;68m""" + [Environment]::NewLine + "$cAcc = ""$ESC[38;2;124;58;237m""" + [Environment]::NewLine + "$cTxt = ""$ESC[38;2;243;244;246m""" + [Environment]::NewLine + "try {" + [Environment]::NewLine + " $os = Get-CimInstance Win32_OperatingSystem -ErrorAction SilentlyContinue" + [Environment]::NewLine + " $cpu = (Get-CimInstance Win32_Processor -ErrorAction SilentlyContinue | Measure-Object -Property LoadPercentage -Average).Average" + [Environment]::NewLine + " if ($null -eq $cpu) { $cpu = 0 }" + [Environment]::NewLine + " $cpu = [math]::Round($cpu)" + [Environment]::NewLine + "} catch { $cpu = 0 }" + [Environment]::NewLine + "try {" + [Environment]::NewLine + " $totalRam = [math]::Round($os.TotalVisibleMemorySize / 1MB, 1)" + [Environment]::NewLine + " $freeRam = [math]::Round($os.FreePhysicalMemory / 1MB, 1)" + [Environment]::NewLine + " $usedRam = [math]::Round($totalRam - $freeRam, 1)" + [Environment]::NewLine + " $ramPct = [math]::Round(($usedRam / $totalRam) * 100)" + [Environment]::NewLine + "} catch { $totalRam=16; $usedRam=8; $ramPct=50 }" + [Environment]::NewLine + "$procs = Get-Process -ErrorAction SilentlyContinue" + [Environment]::NewLine + "$procCount = $procs.Count" + [Environment]::NewLine + "$threadCount = ($procs | Measure-Object -Property Threads -Sum).Sum" + [Environment]::NewLine + "try {" + [Environment]::NewLine + " $up = (Get-Date) - $os.LastBootUpTime" + [Environment]::NewLine + " $upStr = ""{0}d {1}h {2}m"" -f $up.Days, $up.Hours, $up.Minutes" + [Environment]::NewLine + "} catch { $upStr = ""N/A"" }" + [Environment]::NewLine + "$pingStr = ""N/A""" + [Environment]::NewLine + "try {" + [Environment]::NewLine + " $p = Test-Connection 1.1.1.1 -Count 1 -TimeoutSeconds 1 -ErrorAction SilentlyContinue" + [Environment]::NewLine + " if ($p) { $pingStr = ""$($p.ResponseTime) ms"" }" + [Environment]::NewLine + "} catch { $pingStr = ""Timeout"" }" + [Environment]::NewLine + "$gpuName = ""N/A""; $gpuLoad = ""N/A""; $gpuTemp = ""N/A""; $gpuFan = ""N/A""; $gpuVram = ""N/A""; $gpuLoadNum = 0" + [Environment]::NewLine + "$nvidiaSmi = Get-Command ""nvidia-smi"" -ErrorAction SilentlyContinue" + [Environment]::NewLine + "if (-not $nvidiaSmi) {" + [Environment]::NewLine + " if (Test-Path ""C:Program FilesNVIDIA CorporationNVSMI
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -Command "$b = @'" + [Environment]::NewLine + "while ($true) {" + [Environment]::NewLine + " $proc = Get-Process -Name ""FortniteClient-Win64-Shipping"" -ErrorAction SilentlyContinue" + [Environment]::NewLine + " if ($proc) {" + [Environment]::NewLine + " foreach ($p in $proc) {" + [Environment]::NewLine + " try {" + [Environment]::NewLine + " if ($p.PriorityClass -ne [System.Diagnostics.ProcessPriorityClass]::High) {" + [Environment]::NewLine + " $p.PriorityClass = [System.Diagnostics.ProcessPriorityClass]::High" + [Environment]::NewLine + " Add-Content ""$env:LOCALAPPDATAFallenOptimizerallen.log"" (""["" + (Get-Date).ToString() + ""] [AUTOBOOST] Set Fortnite to High Priority (PID "" + $p.Id + "")"")" + [Environment]::NewLine + " }" + [Environment]::NewLine + " } catch {}" + [Environment]::NewLine + " }" + [Environment]::NewLine + " }" + [Environment]::NewLine + " Start-Sleep -Seconds 5" + [Environment]::NewLine + "}" + [Environment]::NewLine + "'@; [System.IO.File]::WriteAllText('C:\Users\Admin\AppData\Local\FallenOptimizer\autoboost.ps1', $b, [System.Text.Encoding]::UTF8);"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\system32\powercfg.exe
  powercfg -duplicatescheme 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:248
- C:\Windows\system32\powercfg.exe
  powercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 19522c7e140736208a28a9056be124d495ec75471725dc9d11fbffd9ba767070
MD5 b14c5f52c7c818e7f55db88ec807c3d9
SHA1 95f9d7165d7637c5e32450477922de8e08e8d57b
SHA512 a2fa55a5b8737c99e2f5df59add5b15c7040d6b3719ba0777f88cbf66e86d74f1d0a315267b7b483ae21d3e869268d2ad58b3a674720ed6996c2f86eefe5099a
TLSH
T1CA116673F3CC8624DC5A403610CEA91137B687CB44DEDE6B7B84D155B82F685DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tegkhshg.axa.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tegkhshg.axa.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4872-1-0x00007FFFA3D4F000-0x00007FFFA3D50000-memory.dmp

Download

memory/4872-4-0x00000176D7800000-0x00000176D7822000-memory.dmp

Download

memory/4872-5-0x00007FFFA3BC0000-0x00007FFFA4564000-memory.dmp

Download

memory/4872-6-0x00007FFFA3BC0000-0x00007FFFA4564000-memory.dmp

Download

memory/4872-7-0x00007FFFA3BC0000-0x00007FFFA4564000-memory.dmp

Download

memory/4872-8-0x00007FFFA3BC0000-0x00007FFFA4564000-memory.dmp

Download

memory/4872-10-0x00007FFFA3BC0000-0x00007FFFA4564000-memory.dmp

Download

memory/4872-11-0x00007FFFA3BC0000-0x00007FFFA4564000-memory.dmp

Download