fa96de12bcb2c15bc9b05b8212438ade0de0c2b800a23eac908d5c1e36996d77

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
autodivert.bat
Size 18KB
Sample261029-wfpg2sey2m
SHA256 fa96de12bcb2c15bc9b05b8212438ade0de0c2b800a23eac908d5c1e36996d77
MD5 1d15127555ba9bcbedc778f08e561cff
SHA1 404a2c1fbf9f4f2a94e5b72f010e0386836852ca
SHA512 7450f86f6eb764dbcb8a6f6fc72b170d8ef61f73ef1fba2e438e8497883c6d685558a6ddaca3ea3e8de8519871a2f2531176de7042f0ceee0e7e6e7172ef595e
SSDEEP 384:wyBUbKald6elDc6IOcS1AOOuDlnxz5aEm/u9YJ52:KbK0d6elDc6RTOXqhxlaEm/u9C52
TLSH
T1E482D9167E849C891CD4EAA3A9052311F39081CBD41A1EEA70EFC174F79F2E695FD294
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	5956	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5956	powershell.exe
2168	powershell.exe
2088	powershell.exe
3396	powershell.exe
5572	powershell.exe
1244	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1780	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2716	cmd.exe
3160	cmd.exe
3176	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1780	powershell.exe
1780	powershell.exe
1780	powershell.exe
5956	powershell.exe
5956	powershell.exe
2168	powershell.exe
2168	powershell.exe
2088	powershell.exe
2088	powershell.exe
3396	powershell.exe
3396	powershell.exe
5572	powershell.exe
5572	powershell.exe
1244	powershell.exe
1244	powershell.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeIncreaseQuotaPrivilege	1780	powershell.exe
Token: SeSecurityPrivilege	1780	powershell.exe
Token: SeTakeOwnershipPrivilege	1780	powershell.exe
Token: SeLoadDriverPrivilege	1780	powershell.exe
Token: SeSystemProfilePrivilege	1780	powershell.exe
Token: SeSystemtimePrivilege	1780	powershell.exe
Token: SeProfSingleProcessPrivilege	1780	powershell.exe
Token: SeIncBasePriorityPrivilege	1780	powershell.exe
Token: SeCreatePagefilePrivilege	1780	powershell.exe
Token: SeBackupPrivilege	1780	powershell.exe
Token: SeRestorePrivilege	1780	powershell.exe
Token: SeShutdownPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeSystemEnvironmentPrivilege	1780	powershell.exe
Token: SeRemoteShutdownPrivilege	1780	powershell.exe
Token: SeUndockPrivilege	1780	powershell.exe
Token: SeManageVolumePrivilege	1780	powershell.exe
Token: 33	1780	powershell.exe
Token: 34	1780	powershell.exe
Token: 35	1780	powershell.exe
Token: 36	1780	powershell.exe
Token: SeDebugPrivilege	5956	powershell.exe
Token: SeDebugPrivilege	2168	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	3396	powershell.exe
Token: SeDebugPrivilege	5572	powershell.exe
Token: SeDebugPrivilege	1244	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 2724	3176	cmd.exe	90
PID 3176 wrote to memory of 1292	3176	cmd.exe	91
PID 1292 wrote to memory of 4828	1292	net.exe	92
PID 3176 wrote to memory of 2716	3176	cmd.exe	93
PID 2716 wrote to memory of 1780	2716	cmd.exe	94
PID 3176 wrote to memory of 3160	3176	cmd.exe	96
PID 3160 wrote to memory of 5956	3160	cmd.exe	97
PID 3176 wrote to memory of 2168	3176	cmd.exe	98
PID 3176 wrote to memory of 2088	3176	cmd.exe	99
PID 3176 wrote to memory of 3396	3176	cmd.exe	100
PID 3176 wrote to memory of 5572	3176	cmd.exe	101
PID 3176 wrote to memory of 1244	3176	cmd.exe	102

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\autodivert.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:2724
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1292
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "(Get-NetFirewallRule -DisplayName 'AutoDivert-Block-*' -ErrorAction SilentlyContinue | Measure-Object).Count"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-NetFirewallRule -DisplayName 'AutoDivert-Block-*' -ErrorAction SilentlyContinue | Measure-Object).Count"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "(Invoke-WebRequest -Uri \"https://reddflower.github.io/autodivert_version.html\" -Headers @{\"Cache-Control\"=\"no-cache\"} -UseBasicParsing -TimeoutSec 5).Content.Trim()" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Invoke-WebRequest -Uri \"https://reddflower.github.io/autodivert_version.html\" -Headers @{\"Cache-Control\"=\"no-cache\"} -UseBasicParsing -TimeoutSec 5).Content.Trim()"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Write-Host ' AutoDivert v1.1' -ForegroundColor White -NoNewline; Write-Host ' [new - 1.0]' -ForegroundColor Green"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Write-Host ' 9. Change interval ' -ForegroundColor White -NoNewline; Write-Host '[120s]' -ForegroundColor Green"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Write-Host ' 10. Change log max lines ' -ForegroundColor White -NoNewline; Write-Host '[60]' -ForegroundColor Green"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Write-Host ' 11. Change resort every ' -ForegroundColor White -NoNewline; Write-Host '[100]' -ForegroundColor Green"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Write-Host \" upd. For update 1.0\" -ForegroundColor Green"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9c538fd0cb2b6fb228d2708a8a2226c83d5433d2566ef1a083f8b4d224fa6e51
MD5 0af69d08f6e15c5faaebf530ee5648d1
SHA1 3199abf53254d2f3c619dee071c0a758c7a924f6
SHA512 40404c84cdc9f0574a2431e505b6934dd779d07ac00f3958943a4c9cd340d4b83468f8e2082f4bf0c458cd435984feaa5acd8758896a854c12af891f51837e42
TLSH
T11E21A933B3DC8611CC99013A10CEAC1036BACBDB449ECF9B7B84E659A43F698CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 697bdd216b996b4636f4357d59855b8b63922ad460c312f78c8c5eb66ffe5f5d
MD5 71bb17cd8d3fc4b9d720c938b0a76f89
SHA1 2c6bcd8b1512eacf2b96a35dad3bde5e9264b86e
SHA512 1b8ab05343b596d915d6979baa5048e703ef759166f95891dc4936b78ddefed128ffc2cec1def8e4bb2d9c46312561f76fbae0b2c562f9d2b244f761b199ef51
TLSH
T1B1117A33F3CC8724DC9A407650CEEC1036B6CBDB409ECE5BAB84D548B42F289CEA1160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 61fa021e6fb9bf6e62c66160ca7f4e57206d1371e9779346630293e15afec314
MD5 d124d0f75d79bdc8685649a54958bc58
SHA1 21e5086ea9ff338713774f7fde5b54f23219ce6d
SHA512 22a6a6140d5f7c9e350bdb05594e18c922da2ed95deeda0a26a91e02df9be744e4ca73784eaf642f3d5b5c63b9616a34858a9586bb165f8de17a99901ed81e22
TLSH
T118115733B3CC8724DC9A403650CEAC1136B687DB409EDE6BBB84D548B82F299DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5gfjrykx.bfr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5gfjrykx.bfr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1780-23-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/1780-27-0x0000027AD13A0000-0x0000027AD13BA000-memory.dmp

Download

memory/1780-11-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/1780-18-0x0000027AD0FF0000-0x0000027AD100E000-memory.dmp

Download

memory/1780-19-0x0000027AD1070000-0x0000027AD1122000-memory.dmp

Download

memory/1780-20-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/1780-21-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/1780-22-0x0000027AD1010000-0x0000027AD101A000-memory.dmp

Download

memory/1780-0-0x00007FFBA290F000-0x00007FFBA2910000-memory.dmp

Download

memory/1780-24-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/1780-25-0x0000027AD1040000-0x0000027AD105E000-memory.dmp

Download

memory/1780-10-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/1780-26-0x0000027AD1020000-0x0000027AD102E000-memory.dmp

Download

memory/1780-28-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/1780-29-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/1780-30-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/1780-31-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/1780-32-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/1780-34-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/1780-9-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/1780-7-0x00007FFBA2780000-0x00007FFBA3124000-memory.dmp

Download

memory/1780-1-0x0000027AD0D10000-0x0000027AD0D32000-memory.dmp

Download