5944a133b26ef0facc57dc9bf2f7054fd1d033ad1e2764c0cef9751bd9f46068

Analysis

user interaction
yes
max time kernel
10s
max time network
12s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 01:26

Target
START.bat
Size 1KB
Sample260707-btrjcact2m
SHA256 5944a133b26ef0facc57dc9bf2f7054fd1d033ad1e2764c0cef9751bd9f46068
MD5 9ef228ae41426d77b98f7f30e3fb5eaa
SHA1 cca16def36c0b6c5cdbbb6847c4b39bf48659956
SHA512 664fd77e7587b036bdc84f7e7d69d238c06db50e1012054293a00c604d834788cf31cd08b3cfa632cf4bdd3388f68adbcd7eb6b5cc10dfb588cd83adfa1fe0e8
TLSH
T1C731AB016474D5E0407A42ACD619944BC9C6929F170E18DE307DD0A5AFBDE42ABFBBF8
MD5 SHA1 SHA512 TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4616	cmd.exe
4616	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4924	4616	cmd.exe	87
PID 4924 wrote to memory of 4124	4924	net.exe	88
PID 4616 wrote to memory of 3628	4616	cmd.exe	89
PID 4616 wrote to memory of 2936	4616	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\START.bat"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4124
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:3628
- C:\Windows\system32\where.exe
  where python3.10
  2⤵
  PID:2936