Overview

overview

8

Static

static

1

stub.bat

windows10-2004-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    9s
  • max time network
    4s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/10/2026, 19:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    stub.bat
  • Size 1.2MB
  • Sample261024-ylqcmsdy2r
  • SHA256 36c1f5bdfa8d306befa1a21266d2c3ad5d4ce1545897ad4f8e0ad1223467673b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\stub.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:3328
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -Exec Bypass -Command "$c = Get-Content -Raw 'C:\Users\Admin\AppData\Local\Temp\7307.ps1'; $s = $c.IndexOf('::PS_START::'); if($s -gt 0) { $p = $c.Substring($s + 12); Set-Content -Path 'C:\Users\Admin\AppData\Local\Temp\7307.ps1' -Value $p }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4936
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -Exec Bypass -File "C:\Users\Admin\AppData\Local\Temp\7307.ps1"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2224

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 2KB
        • SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 7690f10617cfb84767bd01ec0e34242b50f10e9205ff1e078dfec1f19cb3293a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        7307.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\7307.ps1
        • Size 1.2MB
        • SHA256 36c1f5bdfa8d306befa1a21266d2c3ad5d4ce1545897ad4f8e0ad1223467673b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7307.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\7307.ps1
        • Size 1.2MB
        • SHA256 cb0c59a9713b2fe1e344f5d07775d0cbdd623b954c76117d54e40ce3ef29bebf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_hkzcwzev.xpo.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hkzcwzev.xpo.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2224-17-0x00000185C26B0000-0x00000185C26C0000-memory.dmp
        Download

        memory/2224-18-0x00000185C26B0000-0x00000185C26C0000-memory.dmp
        Download

        memory/2224-28-0x00000185C26B0000-0x00000185C26C0000-memory.dmp
        Download

        memory/2224-29-0x00000185C26B0000-0x00000185C26C0000-memory.dmp
        Download

        memory/4936-2-0x000001EAFCFE0000-0x000001EAFCFF0000-memory.dmp
        Download

        memory/4936-3-0x000001EAFCFE0000-0x000001EAFCFF0000-memory.dmp
        Download

        memory/4936-6-0x000001EAFCF80000-0x000001EAFCFA2000-memory.dmp
        Download