Analysis
- max time kernel
2s - max time network
4s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/05/2026, 01:57
Static task
static1
Behavioral task
behavioral1
Sample
service (4).bat
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target service (4).bat
- Size 4.2MB
- Sample260505-cdg6eaax2q
- SHA256 9d9244972ee1927149f900e120f4ba514afd295fc368198bfb237476549eab01
- MD5 0f985d86d6a6e2bab7e5b33f7791603e
- SHA1 82c5d7c5e026e3c079c6c6eaf62c564dc11637d7
- SHA512 2d60144c26d2cb0b7835534689cec921c570d34f12b5baf17aaaae6fdd5e093d9b742909f5cef69e09614c1b5549400e77e46538fcdd1a9fc00ff01cd5a869cf
- SSDEEP 49152:2+0h36JRQDb8NIui4nCjfYtqx4YsQM2b/wroh9Sa/OqANPsL:GdeY
- TLSH T1C426120388DF1A8E377C9596486E0F453BE8677C223E58ED53617AE421B7DC1BB02939
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5468 WMIC.exe Token: SeSecurityPrivilege 5468 WMIC.exe Token: SeTakeOwnershipPrivilege 5468 WMIC.exe Token: SeLoadDriverPrivilege 5468 WMIC.exe Token: SeSystemProfilePrivilege 5468 WMIC.exe Token: SeSystemtimePrivilege 5468 WMIC.exe Token: SeProfSingleProcessPrivilege 5468 WMIC.exe Token: SeIncBasePriorityPrivilege 5468 WMIC.exe Token: SeCreatePagefilePrivilege 5468 WMIC.exe Token: SeBackupPrivilege 5468 WMIC.exe Token: SeRestorePrivilege 5468 WMIC.exe Token: SeShutdownPrivilege 5468 WMIC.exe Token: SeDebugPrivilege 5468 WMIC.exe Token: SeSystemEnvironmentPrivilege 5468 WMIC.exe Token: SeRemoteShutdownPrivilege 5468 WMIC.exe Token: SeUndockPrivilege 5468 WMIC.exe Token: SeManageVolumePrivilege 5468 WMIC.exe Token: 33 5468 WMIC.exe Token: 34 5468 WMIC.exe Token: 35 5468 WMIC.exe Token: 36 5468 WMIC.exe Token: SeIncreaseQuotaPrivilege 5468 WMIC.exe Token: SeSecurityPrivilege 5468 WMIC.exe Token: SeTakeOwnershipPrivilege 5468 WMIC.exe Token: SeLoadDriverPrivilege 5468 WMIC.exe Token: SeSystemProfilePrivilege 5468 WMIC.exe Token: SeSystemtimePrivilege 5468 WMIC.exe Token: SeProfSingleProcessPrivilege 5468 WMIC.exe Token: SeIncBasePriorityPrivilege 5468 WMIC.exe Token: SeCreatePagefilePrivilege 5468 WMIC.exe Token: SeBackupPrivilege 5468 WMIC.exe Token: SeRestorePrivilege 5468 WMIC.exe Token: SeShutdownPrivilege 5468 WMIC.exe Token: SeDebugPrivilege 5468 WMIC.exe Token: SeSystemEnvironmentPrivilege 5468 WMIC.exe Token: SeRemoteShutdownPrivilege 5468 WMIC.exe Token: SeUndockPrivilege 5468 WMIC.exe Token: SeManageVolumePrivilege 5468 WMIC.exe Token: 33 5468 WMIC.exe Token: 34 5468 WMIC.exe Token: 35 5468 WMIC.exe Token: 36 5468 WMIC.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3232 wrote to memory of 5468 3232 cmd.exe 85 PID 3232 wrote to memory of 1728 3232 cmd.exe 86
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\service (4).bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get manufacturer,model2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5468
-
-
C:\Windows\system32\findstr.exefindstr /i "vmware virtualbox qemu xen parallels dady virtual vbox innotek"2⤵PID:1728
-