Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
13/04/2026, 21:54
Static task
static1
Behavioral task
behavioral1
Sample
service.bat
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
service.bat
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target service.bat
- Size 203KB
- Sample260413-1se7csby8v
- SHA256 dea6cfb3234780ceeea718787e027cc6d2de18cfead1f8cc234e0ad268987868
- MD5 63a7ca2cae91c110169accff1d53a2e8
- SHA1 dccc0653c9174c88fe9fa4a83258f6a7fdd196da
- SHA512 756e9b5c488d5b5b0ee4fac8f64b599cfc0db59883565c94b942c73a50a52ddde8ee5da13c6de4915fc6d3b2e528764f913e14227fa85788e7396f7f409e8a1e
- SSDEEP 6144:cWFcvYSqZWRIYj2L0q8EvS4WrCy6Kq4RS1230XiN:HivYHwsxvSkkS230XiN
- TLSH T1F314015B9C534C5DB359004A9C7BAF260363EE340A5F4DDEE785B4CA84F3AD8B606178
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5108 WMIC.exe Token: SeSecurityPrivilege 5108 WMIC.exe Token: SeTakeOwnershipPrivilege 5108 WMIC.exe Token: SeLoadDriverPrivilege 5108 WMIC.exe Token: SeSystemProfilePrivilege 5108 WMIC.exe Token: SeSystemtimePrivilege 5108 WMIC.exe Token: SeProfSingleProcessPrivilege 5108 WMIC.exe Token: SeIncBasePriorityPrivilege 5108 WMIC.exe Token: SeCreatePagefilePrivilege 5108 WMIC.exe Token: SeBackupPrivilege 5108 WMIC.exe Token: SeRestorePrivilege 5108 WMIC.exe Token: SeShutdownPrivilege 5108 WMIC.exe Token: SeDebugPrivilege 5108 WMIC.exe Token: SeSystemEnvironmentPrivilege 5108 WMIC.exe Token: SeRemoteShutdownPrivilege 5108 WMIC.exe Token: SeUndockPrivilege 5108 WMIC.exe Token: SeManageVolumePrivilege 5108 WMIC.exe Token: 33 5108 WMIC.exe Token: 34 5108 WMIC.exe Token: 35 5108 WMIC.exe Token: 36 5108 WMIC.exe Token: SeIncreaseQuotaPrivilege 5108 WMIC.exe Token: SeSecurityPrivilege 5108 WMIC.exe Token: SeTakeOwnershipPrivilege 5108 WMIC.exe Token: SeLoadDriverPrivilege 5108 WMIC.exe Token: SeSystemProfilePrivilege 5108 WMIC.exe Token: SeSystemtimePrivilege 5108 WMIC.exe Token: SeProfSingleProcessPrivilege 5108 WMIC.exe Token: SeIncBasePriorityPrivilege 5108 WMIC.exe Token: SeCreatePagefilePrivilege 5108 WMIC.exe Token: SeBackupPrivilege 5108 WMIC.exe Token: SeRestorePrivilege 5108 WMIC.exe Token: SeShutdownPrivilege 5108 WMIC.exe Token: SeDebugPrivilege 5108 WMIC.exe Token: SeSystemEnvironmentPrivilege 5108 WMIC.exe Token: SeRemoteShutdownPrivilege 5108 WMIC.exe Token: SeUndockPrivilege 5108 WMIC.exe Token: SeManageVolumePrivilege 5108 WMIC.exe Token: 33 5108 WMIC.exe Token: 34 5108 WMIC.exe Token: 35 5108 WMIC.exe Token: 36 5108 WMIC.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3108 wrote to memory of 5108 3108 cmd.exe 80 PID 3108 wrote to memory of 5076 3108 cmd.exe 81
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\service.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get manufacturer,model2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5108
-
-
C:\Windows\system32\findstr.exefindstr /i "vmware virtualbox qemu xen parallels dady virtual vbox innotek"2⤵PID:5076
-