4b298c1540bb1e53ce17621b5b53783216a2c2e2505274e3764cf48a149cedf8

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/03/2026, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87ofjz.bat
Size 1.2MB
Sample260309-hlfkfaet21
SHA256 4b298c1540bb1e53ce17621b5b53783216a2c2e2505274e3764cf48a149cedf8
MD5 d560ef9f7a5d1f1880fb862c3c8d3a27
SHA1 204e78f8776abe2ac5d1185c010110ea7781e95c
SHA512 5e72402f906567892b3051eeffd5c6e907e599608cf22ee9748eb4c6125fc5001994ce7f7d94e9a9b63e81dd316898a86c782b6ef735ce87c1855d2a10b62158
SSDEEP 3072:O14KqqZwUjiPaPZEEElR7jrLw8yzaPaPwPaPoPaPGP9PYEEE0R7jrL:O14loaoWoeoE1S
TLSH
T1C855544057218010D5B2368EE66B7D116BADF14F74E06BD321EEBB0AD8CB91DC2E53E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3228	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Kills process with taskkill 11 IoCs

defense_evasion

pid	Process
5032	taskkill.exe
5060	taskkill.exe
5496	taskkill.exe
3168	taskkill.exe
2600	taskkill.exe
348	taskkill.exe
2740	taskkill.exe
5920	taskkill.exe
5972	taskkill.exe
3920	taskkill.exe
2916	taskkill.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	taskkill.exe
Token: SeDebugPrivilege	5032	taskkill.exe
Token: SeDebugPrivilege	5060	taskkill.exe
Token: SeDebugPrivilege	5920	taskkill.exe
Token: SeDebugPrivilege	5972	taskkill.exe
Token: SeDebugPrivilege	3920	taskkill.exe
Token: SeDebugPrivilege	5496	taskkill.exe
Token: SeDebugPrivilege	3168	taskkill.exe
Token: SeDebugPrivilege	2600	taskkill.exe
Token: SeDebugPrivilege	2916	taskkill.exe
Token: SeDebugPrivilege	348	taskkill.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2740	1848	cmd.exe	79
PID 1848 wrote to memory of 5032	1848	cmd.exe	81
PID 1848 wrote to memory of 5060	1848	cmd.exe	82
PID 1848 wrote to memory of 5920	1848	cmd.exe	83
PID 1848 wrote to memory of 5972	1848	cmd.exe	84
PID 1848 wrote to memory of 3920	1848	cmd.exe	85
PID 1848 wrote to memory of 5496	1848	cmd.exe	86
PID 1848 wrote to memory of 3168	1848	cmd.exe	87
PID 1848 wrote to memory of 2600	1848	cmd.exe	88
PID 1848 wrote to memory of 2916	1848	cmd.exe	89
PID 1848 wrote to memory of 348	1848	cmd.exe	90
PID 1848 wrote to memory of 3332	1848	cmd.exe	91
PID 1848 wrote to memory of 1696	1848	cmd.exe	92
PID 1848 wrote to memory of 5620	1848	cmd.exe	93
PID 1848 wrote to memory of 5320	1848	cmd.exe	94
PID 1848 wrote to memory of 5168	1848	cmd.exe	95
PID 1848 wrote to memory of 3540	1848	cmd.exe	96
PID 1848 wrote to memory of 1980	1848	cmd.exe	97
PID 1848 wrote to memory of 5916	1848	cmd.exe	98
PID 1848 wrote to memory of 1512	1848	cmd.exe	99
PID 1848 wrote to memory of 5992	1848	cmd.exe	100
PID 1848 wrote to memory of 1600	1848	cmd.exe	101
PID 1848 wrote to memory of 2272	1848	cmd.exe	102
PID 1848 wrote to memory of 1228	1848	cmd.exe	103
PID 1848 wrote to memory of 652	1848	cmd.exe	104
PID 1848 wrote to memory of 5572	1848	cmd.exe	105
PID 1848 wrote to memory of 2468	1848	cmd.exe	106
PID 1848 wrote to memory of 4660	1848	cmd.exe	107
PID 1848 wrote to memory of 4084	1848	cmd.exe	108
PID 1848 wrote to memory of 3228	1848	cmd.exe	109

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\87ofjz.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\system32\taskkill.exe
  taskkill /f /im epicgameslauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2740
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicWebHelper.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5032
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5060
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5920
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5972
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3920
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5496
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3168
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEServices.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2916
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BattleEye.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:348
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SYSTEM\ControlSet001\Services\EpicOnlineServices"" /f
  2⤵
  PID:3332
- C:\Windows\system32\reg.exe
  reg delete ""HKCU\SOFTWARE\Epic Games"" /f
  2⤵
  PID:1696
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SOFTWARE\Classes\com.epicgames.launcher"" /f
  2⤵
  PID:5620
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SYSTEM\ControlSet001\Services\BEService"" /f
  2⤵
  PID:5320
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SYSTEM\ControlSet001\Services\BEDaisy"" /f
  2⤵
  PID:5168
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat"" /f
  2⤵
  PID:3540
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SYSTEM\CurrentControlSet\Services\BEService"" /f
  2⤵
  PID:1980
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SYSTEM\CurrentControlSet\Services\BEDaisy"" /f
  2⤵
  PID:5916
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SYSTEM\CurrentControlSet\Services\EasyAntiCheat"" /f
  2⤵
  PID:1512
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat"" /f
  2⤵
  PID:5992
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SOFTWARE\WOW6432Node\Epic Games"" /f
  2⤵
  PID:1600
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged"" /f
  2⤵
  PID:2272
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications"" /f
  2⤵
  PID:1228
- C:\Windows\system32\reg.exe
  reg delete ""HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\com.epicgames.launcher"" /f
  2⤵
  PID:652
- C:\Windows\system32\reg.exe
  reg delete ""HKCR\com.epicgames.eos"" /f
  2⤵
  PID:5572
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\DiagnosedApplications"" /f
  2⤵
  PID:2468
- C:\Windows\system32\reg.exe
  reg delete ""HKLM\SOFTWARE\EpicGames"" /f
  2⤵
  PID:4660
- C:\Windows\system32\reg.exe
  reg delete ""HKEY_USERS\S-1-5-18\Software\Epic Games"" /f
  2⤵
  PID:4084
- C:\Windows\system32\netsh.exe
  netsh advfirewall reset
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3228