Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/04/2026, 21:54
Static task
static1
Behavioral task
behavioral1
Sample
service.bat
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
service.bat
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target service.bat
- Size 203KB
- Sample260413-1se7csby8v
- SHA256 dea6cfb3234780ceeea718787e027cc6d2de18cfead1f8cc234e0ad268987868
- MD5 63a7ca2cae91c110169accff1d53a2e8
- SHA1 dccc0653c9174c88fe9fa4a83258f6a7fdd196da
- SHA512 756e9b5c488d5b5b0ee4fac8f64b599cfc0db59883565c94b942c73a50a52ddde8ee5da13c6de4915fc6d3b2e528764f913e14227fa85788e7396f7f409e8a1e
- SSDEEP 6144:cWFcvYSqZWRIYj2L0q8EvS4WrCy6Kq4RS1230XiN:HivYHwsxvSkkS230XiN
- TLSH T1F314015B9C534C5DB359004A9C7BAF260363EE340A5F4DDEE785B4CA84F3AD8B606178
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4360 WMIC.exe Token: SeSecurityPrivilege 4360 WMIC.exe Token: SeTakeOwnershipPrivilege 4360 WMIC.exe Token: SeLoadDriverPrivilege 4360 WMIC.exe Token: SeSystemProfilePrivilege 4360 WMIC.exe Token: SeSystemtimePrivilege 4360 WMIC.exe Token: SeProfSingleProcessPrivilege 4360 WMIC.exe Token: SeIncBasePriorityPrivilege 4360 WMIC.exe Token: SeCreatePagefilePrivilege 4360 WMIC.exe Token: SeBackupPrivilege 4360 WMIC.exe Token: SeRestorePrivilege 4360 WMIC.exe Token: SeShutdownPrivilege 4360 WMIC.exe Token: SeDebugPrivilege 4360 WMIC.exe Token: SeSystemEnvironmentPrivilege 4360 WMIC.exe Token: SeRemoteShutdownPrivilege 4360 WMIC.exe Token: SeUndockPrivilege 4360 WMIC.exe Token: SeManageVolumePrivilege 4360 WMIC.exe Token: 33 4360 WMIC.exe Token: 34 4360 WMIC.exe Token: 35 4360 WMIC.exe Token: 36 4360 WMIC.exe Token: SeIncreaseQuotaPrivilege 4360 WMIC.exe Token: SeSecurityPrivilege 4360 WMIC.exe Token: SeTakeOwnershipPrivilege 4360 WMIC.exe Token: SeLoadDriverPrivilege 4360 WMIC.exe Token: SeSystemProfilePrivilege 4360 WMIC.exe Token: SeSystemtimePrivilege 4360 WMIC.exe Token: SeProfSingleProcessPrivilege 4360 WMIC.exe Token: SeIncBasePriorityPrivilege 4360 WMIC.exe Token: SeCreatePagefilePrivilege 4360 WMIC.exe Token: SeBackupPrivilege 4360 WMIC.exe Token: SeRestorePrivilege 4360 WMIC.exe Token: SeShutdownPrivilege 4360 WMIC.exe Token: SeDebugPrivilege 4360 WMIC.exe Token: SeSystemEnvironmentPrivilege 4360 WMIC.exe Token: SeRemoteShutdownPrivilege 4360 WMIC.exe Token: SeUndockPrivilege 4360 WMIC.exe Token: SeManageVolumePrivilege 4360 WMIC.exe Token: 33 4360 WMIC.exe Token: 34 4360 WMIC.exe Token: 35 4360 WMIC.exe Token: 36 4360 WMIC.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4648 wrote to memory of 4360 4648 cmd.exe 87 PID 4648 wrote to memory of 6100 4648 cmd.exe 88
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\service.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get manufacturer,model2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4360
-
-
C:\Windows\system32\findstr.exefindstr /i "vmware virtualbox qemu xen parallels dady virtual vbox innotek"2⤵PID:6100
-