fb36ec4f62af3bc9427a2cda4e5f10cb75210f6840c54e493468c487e017a953

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
taskhost40.bat
Size 251B
Sample260529-2thjjsdw2k
SHA256 fb36ec4f62af3bc9427a2cda4e5f10cb75210f6840c54e493468c487e017a953
MD5 9f44cc541bcdf5c270aa69fe2e3a56ef
SHA1 91db3c70a14aed83919ceb9a39c543375ef547e2
SHA512 4e94e647cf2147cfe10aa0797edaaec3010c8a57f49f3aca4aada6851be81ee206c00eb64b915dac1cf7ebe1d5afe9def642b509eeb2b67ddf5a8f4c4d073a50
TLSH
T10AD05B50B8255155CA63B510948F1803F7EBD2C364519791754660625067145C07D6D6
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion evasion trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4960	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4960	taskkill.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 4224	5076	cmd.exe	81
PID 5076 wrote to memory of 2288	5076	cmd.exe	82
PID 5076 wrote to memory of 4960	5076	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\taskhost40.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden /t REG_DWORD /d 1 /f
  2⤵
  PID:4224
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:2288
- C:\Windows\system32\taskkill.exe
  taskkill /f /im avp.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads