324bf25daa4c4b0ae3f813fa9af09ed2e222962753fa0e72c61e9df32643d12d

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 16:03

Target
eon external.bat
Size 340B
Sample260622-thh2yaev3z
SHA256 324bf25daa4c4b0ae3f813fa9af09ed2e222962753fa0e72c61e9df32643d12d
MD5 7d1b9ba9e7584e6bdf97671ffe9b168f
SHA1 09695dc68cd449e730a8e78f44e15228c883463a
SHA512 934d75169188370bdd1a9b406f11d6727d9059fa73e000fda740221aaa37f1a5ebe1c1667a92f4b687af9010b91f39215826f46bfbbdeb4c3b72e0fa0226b131
TLSH
T13EE0485B30264297045035F41E7D3193298D6257EC197AE13256913C865B88276D688C
MD5 SHA1 SHA512 TLSH

Score

3^/10

defense_evasion

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 4 IoCs

defense_evasion

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2968	2720	cmd.exe	89
PID 2720 wrote to memory of 5928	2720	cmd.exe	90
PID 2720 wrote to memory of 2264	2720	cmd.exe	91
PID 2720 wrote to memory of 4448	2720	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\eon external.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2968
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5928
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2264
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4448

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact