910dd39737603e6312beaf174de439c86e7b867bfac2bbdef9bc9421f5d9d58d

Analysis

max time kernel
149s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Otomatik-Baslat-Kur.bat
Size 1KB
Sample261027-eex95a1vcw
SHA256 910dd39737603e6312beaf174de439c86e7b867bfac2bbdef9bc9421f5d9d58d
MD5 4ca017efd4d948a2661c5b5a7a3e4fc9
SHA1 b52b68f4433ba2c32eb36ae159ffe09f94b4698d
SHA512 5d1a2ffb5c7addd906fd3e0a9777b1f0e9ad4805b0116c2c9e680c71a64d0869bdc572f5b65f3aaaf3ffa015535bb5a4e56af4018fc28ea3d20058b662c2e536
TLSH
T189211022B1698B2049BAA354CD1D2495F70380EF127AEC4E7A0F842A0F943D3C5F89C2
MD5 SHA1 SHA512 TLSH

Score

7^/10

execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpotifyDiscordWatcher.lnk	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1356	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5288	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1356	powershell.exe
1356	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1356	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5288 wrote to memory of 4796	5288	cmd.exe	90
PID 5288 wrote to memory of 1356	5288	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Otomatik-Baslat-Kur.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5288
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SpotifyDiscordWatcher.lnk'); $s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\SpotifyDiscordWatcher.exe'; $s.WorkingDirectory = 'C:\Users\Admin\AppData\Local\Temp\'; $s.Description = 'Spotify Discord Lyrics Watcher Service'; $s.Save()"
  2⤵
  - Creates a file in the Startup directory
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_nuzikjoz.42i.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nuzikjoz.42i.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1356-11-0x00007FFB11CE0000-0x00007FFB12684000-memory.dmp

Download

memory/1356-7-0x000002219E3D0000-0x000002219E3F2000-memory.dmp

Download

memory/1356-1-0x00007FFB11CE0000-0x00007FFB12684000-memory.dmp

Download

memory/1356-8-0x00007FFB11CE0000-0x00007FFB12684000-memory.dmp

Download

memory/1356-10-0x00007FFB11CE0000-0x00007FFB12684000-memory.dmp

Download

memory/1356-0-0x00007FFB11E6F000-0x00007FFB11E70000-memory.dmp

Download

memory/1356-12-0x00007FFB11CE0000-0x00007FFB12684000-memory.dmp

Download

memory/1356-13-0x00007FFB11CE0000-0x00007FFB12684000-memory.dmp

Download

memory/1356-14-0x00007FFB11CE0000-0x00007FFB12684000-memory.dmp

Download

memory/1356-15-0x00007FFB11CE0000-0x00007FFB12684000-memory.dmp

Download

memory/1356-18-0x00007FFB11CE0000-0x00007FFB12684000-memory.dmp

Download

memory/1356-19-0x00007FFB11CE0000-0x00007FFB12684000-memory.dmp

Download