9ef6e0491b7dec67f6a912dec5095e59eab0fe16a5b1266b8766646ef03105c5

Analysis

max time kernel
39s
max time network
25s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Win95_to_Win11_26H2_Ultimate_Suite.bat
Size 9KB
Sample261023-2bg53avy3q
SHA256 9ef6e0491b7dec67f6a912dec5095e59eab0fe16a5b1266b8766646ef03105c5
MD5 e67bb4ec329e178c599951c54da16635
SHA1 d780ae4bb7f7e7a2e58508a30712a9c71cbefc51
SHA512 ce188f8de3f9d97bd6866ba83e5ace08fa0fbe2f8291069925c91e70fcb2da229a1769215930678ce5c57ddb38e17ff94b5d51f7362d3def558645b9a43b2a31
SSDEEP 192:wTDiZ4voDUD8KdoWVSBfDdTi5YI4jb8DUvzp4HDw07XLsHfQITyfX85:wTGZ4vogQso1JTi5+wQyEwAD+v85
TLSH
T1F222E76A3A4D855B58F1CE4BDA380055FD32818F0121AE6CB4BF90396F553D6A3BD6F0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

execution

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3152	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2220	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3152	powershell.exe
3152	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3152	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1172	2220	cmd.exe	90
PID 1172 wrote to memory of 4288	1172	net.exe	91
PID 2220 wrote to memory of 3152	2220	cmd.exe	92
PID 2220 wrote to memory of 2272	2220	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Win95_to_Win11_26H2_Ultimate_Suite.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$PSVersionTable"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3152
- C:\Windows\system32\Dism.exe
  dism.exe /?
  2⤵
  - Drops file in Windows directory
  PID:2272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 282KB
SHA256 874da26e4168b31d6dfb10e6cb935d0c1f8bb7f38370e0642f985f734fbc0b80
MD5 0f038b1889db48f36ea0cd3afc73e63e
SHA1 f968ad9db26021cc51beecba5c45ea378b8a7d10
SHA512 000e4423e7cbb8e9e28da6e3cfb606bcc4157d28a268519c3c80f2e7b34600617487b10e207ba60d17dec1cab026bd6d80333c6faf910c3d87283d6d92b27ee3
SSDEEP 1536:6MnSJgDWpheDdjvHcGMuuxPKVyazc1veDaUaywWQpOnwJbrytZ2iFEaFV+cbkei:2eCqtK
TLSH
T1BE54CF1E67EB0D31A189844372719BFE229635A3B6C8F714BA3FD12AE7C19CD4B5B140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3152-11-0x00007FF863AE0000-0x00007FF864484000-memory.dmp

Download

memory/3152-8-0x00007FF863AE0000-0x00007FF864484000-memory.dmp

Download

memory/3152-9-0x0000020AD7810000-0x0000020AD7832000-memory.dmp

Download

memory/3152-10-0x00007FF863AE0000-0x00007FF864484000-memory.dmp

Download

memory/3152-12-0x00007FF863AE0000-0x00007FF864484000-memory.dmp

Download

memory/3152-4-0x00007FF863C6F000-0x00007FF863C70000-memory.dmp

Download

memory/3152-13-0x00007FF863AE0000-0x00007FF864484000-memory.dmp

Download

memory/3152-14-0x00007FF863AE0000-0x00007FF864484000-memory.dmp

Download

memory/3152-15-0x00007FF863AE0000-0x00007FF864484000-memory.dmp

Download

memory/3152-17-0x00007FF863AE0000-0x00007FF864484000-memory.dmp

Download

memory/3152-18-0x00007FF863AE0000-0x00007FF864484000-memory.dmp

Download

memory/3152-7-0x00007FF863AE0000-0x00007FF864484000-memory.dmp

Download