Analysis
- max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 12:07
Static task
static1
Behavioral task
behavioral1
Sample
Vanish free all optimisations.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Vanish free all optimisations.bat
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target Vanish free all optimisations.bat
- Size 31KB
- Sample260709-pal2eaax9y
- SHA256 8badae70f2b3fcac17af7ea870c5e199108a303fe78b271a9cb113be5a8cb969
- MD5 7fcd4fbc44f33e8f798f64e27ceae976
- SHA1 8d156227367d2b7475bc50a5b68397c3716db27e
- SHA512 db508ec9cfb4a6a5b08aa042a0123b3bd8d5d0de7b4fa208590e2bb59910f4d5c35789a0ae5a778d0b168d1528eda23513da596860e391b50e7be83d2e2c242a
- SSDEEP 384:pHu+An6lSB+1+FgqSa1clfgJTQlYko+2FaoZ27oo4D+GCSF7J+FisfJPYJv1xrz8:M+tqC2dF1vU9sY
- TLSH T15FE2923234540D2A7405EA6DE67389926711B18770206BE972DC74CC3BEE7C4867BEF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1856 powercfg.exe 1908 powercfg.exe 1332 powercfg.exe 1120 powercfg.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4696 WMIC.exe 4696 WMIC.exe 4696 WMIC.exe 4696 WMIC.exe - Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4696 WMIC.exe Token: SeSecurityPrivilege 4696 WMIC.exe Token: SeTakeOwnershipPrivilege 4696 WMIC.exe Token: SeLoadDriverPrivilege 4696 WMIC.exe Token: SeSystemProfilePrivilege 4696 WMIC.exe Token: SeSystemtimePrivilege 4696 WMIC.exe Token: SeProfSingleProcessPrivilege 4696 WMIC.exe Token: SeIncBasePriorityPrivilege 4696 WMIC.exe Token: SeCreatePagefilePrivilege 4696 WMIC.exe Token: SeBackupPrivilege 4696 WMIC.exe Token: SeRestorePrivilege 4696 WMIC.exe Token: SeShutdownPrivilege 4696 WMIC.exe Token: SeDebugPrivilege 4696 WMIC.exe Token: SeSystemEnvironmentPrivilege 4696 WMIC.exe Token: SeRemoteShutdownPrivilege 4696 WMIC.exe Token: SeUndockPrivilege 4696 WMIC.exe Token: SeManageVolumePrivilege 4696 WMIC.exe Token: 33 4696 WMIC.exe Token: 34 4696 WMIC.exe Token: 35 4696 WMIC.exe Token: 36 4696 WMIC.exe Token: SeIncreaseQuotaPrivilege 4696 WMIC.exe Token: SeSecurityPrivilege 4696 WMIC.exe Token: SeTakeOwnershipPrivilege 4696 WMIC.exe Token: SeLoadDriverPrivilege 4696 WMIC.exe Token: SeSystemProfilePrivilege 4696 WMIC.exe Token: SeSystemtimePrivilege 4696 WMIC.exe Token: SeProfSingleProcessPrivilege 4696 WMIC.exe Token: SeIncBasePriorityPrivilege 4696 WMIC.exe Token: SeCreatePagefilePrivilege 4696 WMIC.exe Token: SeBackupPrivilege 4696 WMIC.exe Token: SeRestorePrivilege 4696 WMIC.exe Token: SeShutdownPrivilege 4696 WMIC.exe Token: SeDebugPrivilege 4696 WMIC.exe Token: SeSystemEnvironmentPrivilege 4696 WMIC.exe Token: SeRemoteShutdownPrivilege 4696 WMIC.exe Token: SeUndockPrivilege 4696 WMIC.exe Token: SeManageVolumePrivilege 4696 WMIC.exe Token: 33 4696 WMIC.exe Token: 34 4696 WMIC.exe Token: 35 4696 WMIC.exe Token: 36 4696 WMIC.exe Token: SeShutdownPrivilege 1856 powercfg.exe Token: SeCreatePagefilePrivilege 1856 powercfg.exe Token: SeShutdownPrivilege 1908 powercfg.exe Token: SeCreatePagefilePrivilege 1908 powercfg.exe Token: SeShutdownPrivilege 1332 powercfg.exe Token: SeCreatePagefilePrivilege 1332 powercfg.exe Token: SeShutdownPrivilege 1120 powercfg.exe Token: SeCreatePagefilePrivilege 1120 powercfg.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1932 wrote to memory of 3580 1932 cmd.exe 89 PID 3580 wrote to memory of 4696 3580 cmd.exe 90 PID 1932 wrote to memory of 3456 1932 cmd.exe 92 PID 3456 wrote to memory of 4592 3456 net.exe 93 PID 1932 wrote to memory of 1856 1932 cmd.exe 94 PID 1932 wrote to memory of 1908 1932 cmd.exe 95 PID 1932 wrote to memory of 1332 1932 cmd.exe 96 PID 1932 wrote to memory of 1120 1932 cmd.exe 97
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Vanish free all optimisations.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get localdatetime /value 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\System32\Wbem\WMIC.exewmic os get localdatetime /value3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4696
-
-
-
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:4592
-
-
-
C:\Windows\system32\powercfg.exepowercfg /setacvalueindex SUB_VIDEO VIDEOIDLE 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1856
-
-
C:\Windows\system32\powercfg.exepowercfg /setacvalueindex SUB_SLEEP STANDBYIDLE 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1908
-
-
C:\Windows\system32\powercfg.exepowercfg /setacvalueindex SUB_DISK DISKIDLE 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1332
-
-
C:\Windows\system32\powercfg.exepowercfg /setactive2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1120
-