0dd79f07ec1efbbb4ee3185d977f438dfdd372d7eb085ea3e137680e0dceb775

Analysis

max time kernel
32s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/07/2026, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RUN AS ADMIN FOR A SURPRISE!.bat
Size 1KB
Sample260704-3t1wkae16w
SHA256 0dd79f07ec1efbbb4ee3185d977f438dfdd372d7eb085ea3e137680e0dceb775
MD5 ef0c780baa4539820b1f646d6e382cee
SHA1 8393ba1d19d308c4e7eec576b04cce3b8daa8aaa
SHA512 e9720bdd6663c668fea1b9709810f154d9a79f44236469405f480a3b208a19d6140b1f79cb95149c28dc612ff860b41da1c3991040c425be32cb3959ea4829b2
TLSH
T1CB31F15685C5C22732779430B2212855F2E7D34BA110841EB1D2A194DFBC38DAEF6ADD
MD5 SHA1 SHA512 TLSH

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File created	\??\PhysicalDrive0	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5972 wrote to memory of 6116	5972	cmd.exe	85
PID 5972 wrote to memory of 4216	5972	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RUN AS ADMIN FOR A SURPRISE!.bat"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:5972
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:6116
- C:\Windows\system32\fsutil.exe
  fsutil file createnew zero.bin 512
  2⤵
  PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads