4b298c1540bb1e53ce17621b5b53783216a2c2e2505274e3764cf48a149cedf8

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/03/2026, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87ofjz.bat
Size 1.2MB
Sample260309-hlfkfaet21
SHA256 4b298c1540bb1e53ce17621b5b53783216a2c2e2505274e3764cf48a149cedf8
MD5 d560ef9f7a5d1f1880fb862c3c8d3a27
SHA1 204e78f8776abe2ac5d1185c010110ea7781e95c
SHA512 5e72402f906567892b3051eeffd5c6e907e599608cf22ee9748eb4c6125fc5001994ce7f7d94e9a9b63e81dd316898a86c782b6ef735ce87c1855d2a10b62158
SSDEEP 3072:O14KqqZwUjiPaPZEEElR7jrLw8yzaPaPwPaPoPaPGP9PYEEE0R7jrL:O14loaoWoeoE1S
TLSH
T1C855544057218010D5B2368EE66B7D116BADF14F74E06BD321EEBB0AD8CB91DC2E53E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2344	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Kills process with taskkill 11 IoCs

defense_evasion

pid	Process
5988	taskkill.exe
2864	taskkill.exe
1096	taskkill.exe
6068	taskkill.exe
1972	taskkill.exe
1412	taskkill.exe
4152	taskkill.exe
552	taskkill.exe
5892	taskkill.exe
2824	taskkill.exe
2264	taskkill.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4152	taskkill.exe
Token: SeDebugPrivilege	5988	taskkill.exe
Token: SeDebugPrivilege	552	taskkill.exe
Token: SeDebugPrivilege	5892	taskkill.exe
Token: SeDebugPrivilege	2864	taskkill.exe
Token: SeDebugPrivilege	2824	taskkill.exe
Token: SeDebugPrivilege	1096	taskkill.exe
Token: SeDebugPrivilege	6068	taskkill.exe
Token: SeDebugPrivilege	1972	taskkill.exe
Token: SeDebugPrivilege	2264	taskkill.exe
Token: SeDebugPrivilege	1412	taskkill.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 4152	744	cmd.exe	88
PID 744 wrote to memory of 5988	744	cmd.exe	90
PID 744 wrote to memory of 552	744	cmd.exe	92
PID 744 wrote to memory of 5892	744	cmd.exe	93
PID 744 wrote to memory of 2864	744	cmd.exe	95
PID 744 wrote to memory of 2824	744	cmd.exe	96
PID 744 wrote to memory of 1096	744	cmd.exe	97
PID 744 wrote to memory of 6068	744	cmd.exe	99
PID 744 wrote to memory of 1972	744	cmd.exe	100
PID 744 wrote to memory of 2264	744	cmd.exe	101
PID 744 wrote to memory of 1412	744	cmd.exe	102
PID 744 wrote to memory of 2124	744	cmd.exe	103
PID 744 wrote to memory of 5012	744	cmd.exe	104
PID 744 wrote to memory of 2888	744	cmd.exe	105
PID 744 wrote to memory of 2356	744	cmd.exe	106
PID 744 wrote to memory of 2704	744	cmd.exe	107
PID 744 wrote to memory of 5596	744	cmd.exe	108
PID 744 wrote to memory of 1436	744	cmd.exe	109
PID 744 wrote to memory of 2572	744	cmd.exe	110
PID 744 wrote to memory of 5916	744	cmd.exe	111
PID 744 wrote to memory of 5484	744	cmd.exe	112
PID 744 wrote to memory of 1396	744	cmd.exe	113
PID 744 wrote to memory of 5768	744	cmd.exe	114
PID 744 wrote to memory of 544	744	cmd.exe	115
PID 744 wrote to memory of 2328	744	cmd.exe	116
PID 744 wrote to memory of 3824	744	cmd.exe	117
PID 744 wrote to memory of 916	744	cmd.exe	118
PID 744 wrote to memory of 3068	744	cmd.exe	119
PID 744 wrote to memory of 5536	744	cmd.exe	120
PID 744 wrote to memory of 2344	744	cmd.exe	121

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\87ofjz.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\system32\taskkill.exe
  taskkill /f /im epicgameslauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4152
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicWebHelper.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5988
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:552
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5892
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1096
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6068
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1972
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEServices.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2264
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BattleEye.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1412
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SYSTEM\ControlSet001\Services\EpicOnlineServices"" /f
  2⤵
  PID:2124
- C:\Windows\system32\reg.exe
  reg delete ""HKCU\SOFTWARE\Epic Games"" /f
  2⤵
  PID:5012
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SOFTWARE\Classes\com.epicgames.launcher"" /f
  2⤵
  PID:2888
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SYSTEM\ControlSet001\Services\BEService"" /f
  2⤵
  PID:2356
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SYSTEM\ControlSet001\Services\BEDaisy"" /f
  2⤵
  PID:2704
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat"" /f
  2⤵
  PID:5596
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SYSTEM\CurrentControlSet\Services\BEService"" /f
  2⤵
  PID:1436
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SYSTEM\CurrentControlSet\Services\BEDaisy"" /f
  2⤵
  PID:2572
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SYSTEM\CurrentControlSet\Services\EasyAntiCheat"" /f
  2⤵
  PID:5916
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat"" /f
  2⤵
  PID:5484
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SOFTWARE\WOW6432Node\Epic Games"" /f
  2⤵
  PID:1396
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged"" /f
  2⤵
  PID:5768
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications"" /f
  2⤵
  PID:544
- C:\Windows\system32\reg.exe
  reg delete ""HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\com.epicgames.launcher"" /f
  2⤵
  PID:2328
- C:\Windows\system32\reg.exe
  reg delete ""HKCR\com.epicgames.eos"" /f
  2⤵
  PID:3824
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications"" /f
  2⤵
  PID:916
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SOFTWARE\EpicGames"" /f
  2⤵
  PID:3068
- C:\Windows\system32\reg.exe
  reg delete ""HKEY_USERS\S-1-5-18\Software\Epic Games"" /f
  2⤵
  PID:5536
- C:\Windows\system32\netsh.exe
  netsh advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2344