deaa5d2d0d1c0c52ff741086ea9da3125ea5b802a1eeba4ca267b3f08a6fc942

Resubmissions

25/09/2026, 08:35

260925-kgy74aw1cy8

13/05/2026, 08:16

260513-j6dr1sft6x8

19/04/2026, 14:18

260419-rmh7dshy218

Analysis

user interaction
yes
max time kernel
298s
max time network
284s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
freerobux.bat
Size 1KB
Sample260419-rmh7dshy21
SHA256 deaa5d2d0d1c0c52ff741086ea9da3125ea5b802a1eeba4ca267b3f08a6fc942
MD5 9cf2739a04a84c807c34738d5c099a39
SHA1 db0c871fc74bda3842f1ec3fda066265728e1aee
SHA512 3e0fae7e549a48fe2aa9582c3cbe418bd8155b375c4a2ee45cafb6e2dbe795c44d39738cc42cd274aaf98aad5e22e7de6f1fdaf46fe149e1bdbdd156ff11120e
TLSH
T1A73126002C02899B27A1F471CD153045F569E38B7D1A5BD0B5E2A0986B7F38487BDADD
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4684	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4772	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4772	taskkill.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 4684	436	cmd.exe	81
PID 436 wrote to memory of 2108	436	cmd.exe	82
PID 436 wrote to memory of 3792	436	cmd.exe	83
PID 436 wrote to memory of 1592	436	cmd.exe	84
PID 436 wrote to memory of 4772	436	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\freerobux.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4684
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:2108
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3792
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:1592
- C:\Windows\system32\taskkill.exe
  taskkill /f /IM explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4684-0-0x00000260DC5F0000-0x00000260DC64D000-memory.dmp

Download

memory/4772-1-0x000001938F040000-0x000001938F09D000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads