f822431381d079fa6d6dbe94feffcf79e0c26e46caeb74f13f87f05acb47afba

Analysis

max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/06/2026, 06:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tets.bat
Size 928B
Sample260628-hadlpsf12q
SHA256 f822431381d079fa6d6dbe94feffcf79e0c26e46caeb74f13f87f05acb47afba
MD5 e18d4754e882ba24121b71902ab5b987
SHA1 10b9e5ffd32ea9e095551033d325e2dc7a492304
SHA512 f7b9085d9beed4cde7d87f82a55db16c1c092bc6d991269a46ecc0f63fa0e7914f1a28b3904ecfded70cbdb2d3a61be2e8d2b71fc2a7bdfb6ec11d1660ae542f
TLSH
T16611ED066051013713A498916E1F315CE98E00EB4E016EF9F83288A4AF74AAA01F65EA
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5808 wrote to memory of 4812	5808	cmd.exe	80

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tets.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Windows\system32\curl.exe
  curl -s -L -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" --max-time 10 -o "C:\Users\Admin\AppData\Local\Temp\spam_image.jpg" "https://imgs.search.brave.com/8VOhcF3XWUyd97WKxvOGFyWxsREXnK6j-CEc1z6AyzY/rs:fit:500:0:1:0/g:ce/aHR0cHM6Ly9zdGF0/aWMtY2EtY2RuLmVw/b3JuZXIuY29tL3Ro/dW1icy9zdGF0aWM0/LzEvMTQvMTQ0LzE0/NDA4NjA1LzhfMjQw/LmpwZw"
  2⤵
  PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

spam_image.jpg

Path C:\Users\Admin\AppData\Local\Temp\spam_image.jpg
Size 13KB
SHA256 8db67a3205f2e92c29fe224e711286b9360563a2a0e355d9e56292f5601b02e3
MD5 0906d611dc18ab1cb965cb650c1d0d9f
SHA1 ac903cf9f3e0c123b71fcfd220ed2ef5deaf0bc2
SHA512 da410befaa4d33d37c741948d682084eb98837b4e7986cb697f24dd45cf09fac8b44e0d56146e4a82af0ebc136f331d7ff424bdc28ee25b78de928ee19a9d29a
SSDEEP 192:NlXyRERK17ZKjZcyJGuuYR9wFur8eojPkCOckzycP+26fL6hNbCHEd2q0N/oOkKp:NNyi89Z4Z7UAf18eAPLOV1bP0NAP8
TLSH
T16352BFC2FD004A52DA65D277A4BBF6D3960C90C72D53509F4B02D9AD7F8FEB08642A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download