97ccd46008012e261bb783d4787b0998f03703053a35540f82f6cb8dab5c2e65

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 09:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dene.bat
Size 205KB
Sample260703-kzvbvset4v
SHA256 97ccd46008012e261bb783d4787b0998f03703053a35540f82f6cb8dab5c2e65
MD5 00f7c9caade2c3b4964fd84b7d20b636
SHA1 5c86a27a6e6e3e4635e08aba1379aeb0bf810c16
SHA512 73cb4d0f4e85c3f4cd50e9c9797a2c6a6b0908bf14f39407daec0552ab1886b2315932aef5648eecd674d8b6aef699ab5e366799c29160d1f9845eb1d80ce5b9
SSDEEP 1536:e8HHB0mv9w5szEnSC/DVr1ysIvCFxkrwCrwbr2m+WT:xssedp/D
TLSH
T17D24412A71664362C49DAD265E72DD1A6B2A7EC3D9200F00F4EF20DD0F77491EE798E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1144	powershell.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
1772	timeout.exe
5056	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5876	WMIC.exe
5876	WMIC.exe
5876	WMIC.exe
5876	WMIC.exe
1144	powershell.exe
1144	powershell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5876	WMIC.exe
Token: SeSecurityPrivilege	5876	WMIC.exe
Token: SeTakeOwnershipPrivilege	5876	WMIC.exe
Token: SeLoadDriverPrivilege	5876	WMIC.exe
Token: SeSystemProfilePrivilege	5876	WMIC.exe
Token: SeSystemtimePrivilege	5876	WMIC.exe
Token: SeProfSingleProcessPrivilege	5876	WMIC.exe
Token: SeIncBasePriorityPrivilege	5876	WMIC.exe
Token: SeCreatePagefilePrivilege	5876	WMIC.exe
Token: SeBackupPrivilege	5876	WMIC.exe
Token: SeRestorePrivilege	5876	WMIC.exe
Token: SeShutdownPrivilege	5876	WMIC.exe
Token: SeDebugPrivilege	5876	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5876	WMIC.exe
Token: SeRemoteShutdownPrivilege	5876	WMIC.exe
Token: SeUndockPrivilege	5876	WMIC.exe
Token: SeManageVolumePrivilege	5876	WMIC.exe
Token: 33	5876	WMIC.exe
Token: 34	5876	WMIC.exe
Token: 35	5876	WMIC.exe
Token: 36	5876	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5876	WMIC.exe
Token: SeSecurityPrivilege	5876	WMIC.exe
Token: SeTakeOwnershipPrivilege	5876	WMIC.exe
Token: SeLoadDriverPrivilege	5876	WMIC.exe
Token: SeSystemProfilePrivilege	5876	WMIC.exe
Token: SeSystemtimePrivilege	5876	WMIC.exe
Token: SeProfSingleProcessPrivilege	5876	WMIC.exe
Token: SeIncBasePriorityPrivilege	5876	WMIC.exe
Token: SeCreatePagefilePrivilege	5876	WMIC.exe
Token: SeBackupPrivilege	5876	WMIC.exe
Token: SeRestorePrivilege	5876	WMIC.exe
Token: SeShutdownPrivilege	5876	WMIC.exe
Token: SeDebugPrivilege	5876	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5876	WMIC.exe
Token: SeRemoteShutdownPrivilege	5876	WMIC.exe
Token: SeUndockPrivilege	5876	WMIC.exe
Token: SeManageVolumePrivilege	5876	WMIC.exe
Token: 33	5876	WMIC.exe
Token: 34	5876	WMIC.exe
Token: 35	5876	WMIC.exe
Token: 36	5876	WMIC.exe
Token: SeDebugPrivilege	1144	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 1488	4296	cmd.exe	89
PID 4296 wrote to memory of 4432	4296	cmd.exe	90
PID 4296 wrote to memory of 5056	4296	cmd.exe	91
PID 4296 wrote to memory of 2340	4296	cmd.exe	92
PID 4296 wrote to memory of 1520	4296	cmd.exe	93
PID 1520 wrote to memory of 5876	1520	cmd.exe	94
PID 1520 wrote to memory of 5860	1520	cmd.exe	95
PID 4296 wrote to memory of 1772	4296	cmd.exe	97
PID 4296 wrote to memory of 2012	4296	cmd.exe	98
PID 4296 wrote to memory of 1144	4296	cmd.exe	99
PID 4296 wrote to memory of 2976	4296	cmd.exe	101
PID 4296 wrote to memory of 1008	4296	cmd.exe	102
PID 4296 wrote to memory of 796	4296	cmd.exe	103
PID 4296 wrote to memory of 3916	4296	cmd.exe	104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\dene.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
  2⤵
  PID:1488
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4432
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5056
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path Win32_UserAccount where name="Admin" get sid | findstr "S-"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_UserAccount where name="Admin" get sid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5876
- - C:\Windows\system32\findstr.exe
    findstr "S-"
    3⤵
    PID:5860
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1772
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:2012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile Enable-ComputerRestore -Drive 'C:\'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1144
- C:\Windows\system32\reg.exe
  Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f
  2⤵
  PID:2976
- C:\Windows\system32\reg.exe
  Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
  2⤵
  PID:1008
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
  2⤵
  PID:796
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1144-0-0x0000015DFFC40000-0x0000015DFFC62000-memory.dmp

Download