Analysis
- geolocation tags
eueuropelondonukunited-kingdom - user interaction
yes - max time kernel
30s - max time network
12s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/06/2026, 23:46
Static task
static1
Behavioral task
behavioral1
Sample
install.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
30 seconds
Behavioral task
behavioral2
Sample
install.bat
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
1 signatures
30 seconds
General
- Target install.bat
- Size 2KB
- Sample260622-3sdpmsgz9r
- SHA256 944d24e883d155fe2f23b446da28f49c889601b2422ad58600a94f83ed45338e
- MD5 9b25cfb33fe56de0287deb0e941c5cec
- SHA1 d69bc61856b20e4670715dde3ff288f0c2b84796
- SHA512 497f9c6096c7932b762320b454d8fdb51e47ca2f17d1ea27fde1af8adbb1a8df3c84944f4ccffe381d3cfd5fef5abcd0a64a310adb28566224c8038f325a7378
- TLSH T1E941C92B72A8D5B96A9E8265CC6560337292025F00157CBCF0EF81640F50BD0BBECBE6
- MD5 SHA1 SHA512 TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4984 taskmgr.exe Token: SeSystemProfilePrivilege 4984 taskmgr.exe Token: SeCreateGlobalPrivilege 4984 taskmgr.exe - Suspicious use of FindShellTrayWindow 31 IoCs
pid Process 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe - Suspicious use of SendNotifyMessage 31 IoCs
pid Process 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe 4984 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4612 wrote to memory of 3768 4612 cmd.exe 89
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\install.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\system32\chcp.comchcp 650012⤵PID:3768
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4984