Analysis
- user interaction
yes - max time kernel
299s - max time network
164s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 00:49
General
- Target obfuscate.bat
- Size 137B
- Sample260709-a6d84sb17v
- SHA256 5aa608c5c61e6a2e72381b2d2ca9f04e6a0f0e1fc4fda918f36ea9cf4b3deb6e
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 38 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 36 IoCs
- Suspicious use of FindShellTrayWindow 54 IoCs
- Suspicious use of SendNotifyMessage 43 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\obfuscate.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
memory/2036-2-0x0000021980000000-0x0000021980270000-memory.dmp
memory/2036-11-0x00000219F6F30000-0x00000219F6F31000-memory.dmp
memory/2036-12-0x00000219F6F30000-0x00000219F6F31000-memory.dmp
memory/2036-15-0x0000021980270000-0x0000021980280000-memory.dmp
memory/2036-17-0x0000021980280000-0x0000021980290000-memory.dmp
memory/2036-19-0x0000021980290000-0x00000219802A0000-memory.dmp
memory/2036-22-0x00000219802A0000-0x00000219802B0000-memory.dmp
memory/2036-23-0x00000219802B0000-0x00000219802C0000-memory.dmp
memory/2036-25-0x00000219802C0000-0x00000219802D0000-memory.dmp
memory/2036-27-0x00000219802D0000-0x00000219802E0000-memory.dmp
memory/2036-29-0x00000219802E0000-0x00000219802F0000-memory.dmp
memory/2036-35-0x0000021980300000-0x0000021980310000-memory.dmp
memory/2036-38-0x0000021980310000-0x0000021980320000-memory.dmp
memory/2036-37-0x0000021980270000-0x0000021980280000-memory.dmp
memory/2036-34-0x00000219802F0000-0x0000021980300000-memory.dmp
memory/2036-33-0x0000021980000000-0x0000021980270000-memory.dmp
memory/2036-41-0x0000021980320000-0x0000021980330000-memory.dmp
memory/2036-40-0x0000021980280000-0x0000021980290000-memory.dmp
memory/2036-47-0x00000219802A0000-0x00000219802B0000-memory.dmp
memory/2036-50-0x0000021980350000-0x0000021980360000-memory.dmp
memory/2036-49-0x00000219802B0000-0x00000219802C0000-memory.dmp
memory/2036-46-0x0000021980340000-0x0000021980350000-memory.dmp
memory/2036-45-0x0000021980330000-0x0000021980340000-memory.dmp
memory/2036-44-0x0000021980290000-0x00000219802A0000-memory.dmp
memory/2036-53-0x0000021980360000-0x0000021980370000-memory.dmp
memory/2036-52-0x00000219802C0000-0x00000219802D0000-memory.dmp
memory/2036-56-0x0000021980370000-0x0000021980380000-memory.dmp
memory/2036-55-0x00000219802D0000-0x00000219802E0000-memory.dmp
memory/2036-68-0x0000021980300000-0x0000021980310000-memory.dmp
memory/2036-70-0x00000219803C0000-0x00000219803D0000-memory.dmp
memory/2036-67-0x00000219802F0000-0x0000021980300000-memory.dmp
memory/2036-66-0x00000219803B0000-0x00000219803C0000-memory.dmp
memory/2036-65-0x00000219803A0000-0x00000219803B0000-memory.dmp
memory/2036-72-0x0000021980310000-0x0000021980320000-memory.dmp
memory/2036-76-0x0000021980320000-0x0000021980330000-memory.dmp
memory/2036-78-0x0000021980330000-0x0000021980340000-memory.dmp
memory/2036-81-0x0000021980400000-0x0000021980410000-memory.dmp
memory/2036-80-0x00000219803F0000-0x0000021980400000-memory.dmp
memory/2036-79-0x0000021980340000-0x0000021980350000-memory.dmp
memory/2036-75-0x00000219803E0000-0x00000219803F0000-memory.dmp
memory/2036-74-0x00000219803D0000-0x00000219803E0000-memory.dmp
memory/2036-64-0x0000021980390000-0x00000219803A0000-memory.dmp
memory/2036-63-0x0000021980380000-0x0000021980390000-memory.dmp
memory/2036-62-0x00000219802E0000-0x00000219802F0000-memory.dmp
memory/2036-85-0x0000021980410000-0x0000021980420000-memory.dmp
memory/2036-84-0x0000021980350000-0x0000021980360000-memory.dmp
memory/2036-88-0x0000021980360000-0x0000021980370000-memory.dmp
memory/2036-91-0x0000021980370000-0x0000021980380000-memory.dmp
memory/2036-97-0x00000219803B0000-0x00000219803C0000-memory.dmp
memory/2036-99-0x0000021980450000-0x0000021980460000-memory.dmp
memory/2036-98-0x0000021980440000-0x0000021980450000-memory.dmp
memory/2036-103-0x0000021980460000-0x0000021980470000-memory.dmp
memory/2036-102-0x00000219803C0000-0x00000219803D0000-memory.dmp
memory/2036-96-0x00000219803A0000-0x00000219803B0000-memory.dmp
memory/2036-95-0x0000021980390000-0x00000219803A0000-memory.dmp
memory/2036-94-0x0000021980380000-0x0000021980390000-memory.dmp
memory/2036-90-0x0000021980430000-0x0000021980440000-memory.dmp
memory/2036-89-0x0000021980420000-0x0000021980430000-memory.dmp
memory/2036-109-0x00000219803E0000-0x00000219803F0000-memory.dmp
memory/2036-108-0x0000021980480000-0x0000021980490000-memory.dmp
memory/2036-107-0x0000021980470000-0x0000021980480000-memory.dmp
memory/2036-114-0x00000219804A0000-0x00000219804B0000-memory.dmp
memory/2036-113-0x0000021980490000-0x00000219804A0000-memory.dmp
memory/2036-112-0x0000021980400000-0x0000021980410000-memory.dmp
memory/2036-111-0x00000219803F0000-0x0000021980400000-memory.dmp
memory/2036-106-0x00000219803D0000-0x00000219803E0000-memory.dmp
memory/2036-119-0x00000219804B0000-0x00000219804C0000-memory.dmp
memory/2036-118-0x0000021980410000-0x0000021980420000-memory.dmp
memory/2036-122-0x0000021980420000-0x0000021980430000-memory.dmp
memory/2036-124-0x00000219804C0000-0x00000219804D0000-memory.dmp
memory/2036-125-0x00000219804D0000-0x00000219804E0000-memory.dmp
memory/2036-123-0x0000021980430000-0x0000021980440000-memory.dmp
memory/2036-128-0x0000021980450000-0x0000021980460000-memory.dmp
memory/2036-129-0x00000219804E0000-0x00000219804F0000-memory.dmp
memory/2036-127-0x0000021980440000-0x0000021980450000-memory.dmp
memory/2036-138-0x0000021980510000-0x0000021980520000-memory.dmp
memory/2036-140-0x0000021980460000-0x0000021980470000-memory.dmp
memory/2036-139-0x0000021980520000-0x0000021980530000-memory.dmp
memory/2036-145-0x0000021980530000-0x0000021980540000-memory.dmp
memory/2036-148-0x0000021980550000-0x0000021980560000-memory.dmp
memory/2036-147-0x00000219804A0000-0x00000219804B0000-memory.dmp
memory/2036-146-0x0000021980490000-0x00000219804A0000-memory.dmp
memory/2036-143-0x0000021980540000-0x0000021980550000-memory.dmp
memory/2036-142-0x0000021980480000-0x0000021980490000-memory.dmp
memory/2036-141-0x0000021980470000-0x0000021980480000-memory.dmp
memory/2036-137-0x0000021980500000-0x0000021980510000-memory.dmp
memory/2036-135-0x00000219804F0000-0x0000021980500000-memory.dmp
memory/2036-151-0x0000021980560000-0x0000021980570000-memory.dmp
memory/2036-153-0x0000021980570000-0x0000021980580000-memory.dmp
memory/2036-152-0x00000219804B0000-0x00000219804C0000-memory.dmp
memory/2036-158-0x0000021980580000-0x0000021980590000-memory.dmp
memory/2036-157-0x00000219804C0000-0x00000219804D0000-memory.dmp
memory/2036-163-0x00000219804E0000-0x00000219804F0000-memory.dmp
memory/2036-162-0x00000219805A0000-0x00000219805B0000-memory.dmp
memory/2036-161-0x0000021980590000-0x00000219805A0000-memory.dmp
memory/2036-160-0x00000219804D0000-0x00000219804E0000-memory.dmp
memory/2036-168-0x00000219804F0000-0x0000021980500000-memory.dmp
memory/2036-169-0x0000021980500000-0x0000021980510000-memory.dmp
memory/4232-516-0x0000023F94710000-0x0000023F94730000-memory.dmp
memory/4232-490-0x0000023F82A50000-0x0000023F82A70000-memory.dmp
memory/4232-491-0x0000023F82E90000-0x0000023F82F90000-memory.dmp
memory/4232-470-0x0000023F801E0000-0x0000023F802E0000-memory.dmp
memory/4232-502-0x0000023F82C90000-0x0000023F82CB0000-memory.dmp