78d7910d79862da0b6707d90b0d494c3b3bf34ae733072c89b3da79bb4cc8852

Analysis

user interaction
yes
max time kernel
899s
max time network
526s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 04:35

Target
service_remove.cmd
Size 355B
Sample260605-e7y25aaz6w
SHA256 78d7910d79862da0b6707d90b0d494c3b3bf34ae733072c89b3da79bb4cc8852
MD5 527f95833c7bb8fefb5e07f1cb365009
SHA1 bc8af7d526a40b7837f4b37482dc76093411a394
SHA512 23166a1ff60037fbb4014f9f9a5f8a3f67183b60c1bcd2423614ca366d7101e9f36fed27021966a88e8f051cdae1bbf76b48bb023a14bb9db9d9852538bddb07
TLSH
T130E0D8EBB7835E910EC7C3CBFC6B5D637A5942869040A2CA0D11BF56C4111BAA414423
MD5 SHA1 SHA512 TLSH

Score

7^/10

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 848	3996	cmd.exe	81
PID 3996 wrote to memory of 4780	3996	cmd.exe	82
PID 3996 wrote to memory of 2096	3996	cmd.exe	83
PID 3996 wrote to memory of 1672	3996	cmd.exe	84
PID 3996 wrote to memory of 2508	3996	cmd.exe	85
PID 3996 wrote to memory of 1068	3996	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\service_remove.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\system32\sc.exe
  sc stop "GoodbyeDPI"
  2⤵
  - Launches sc.exe
  PID:848
- C:\Windows\system32\sc.exe
  sc delete "GoodbyeDPI"
  2⤵
  - Launches sc.exe
  PID:4780
- C:\Windows\system32\sc.exe
  sc stop "WinDivert"
  2⤵
  - Launches sc.exe
  PID:2096
- C:\Windows\system32\sc.exe
  sc delete "WinDivert"
  2⤵
  - Launches sc.exe
  PID:1672
- C:\Windows\system32\sc.exe
  sc stop "WinDivert14"
  2⤵
  - Launches sc.exe
  PID:2508
- C:\Windows\system32\sc.exe
  sc delete "WinDivert14"
  2⤵
  - Launches sc.exe
  PID:1068