Overview

overview

8

Static

static

1

runner.bat

windows10-2004-x64

8

runner.bat

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    83s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 15:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    runner.bat
  • Size 16KB
  • Sample260709-skprtsdv9x
  • SHA256 ffa77b85f92bbc8c54696f3159072acaa07b6b150a9c9eeddd0b49af45687cfe
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasionexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

    Payload decoded via CertUtil.

    defense_evasion
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\runner.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1164
    • C:\Windows\system32\net.exe
      net session
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4420
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 session
        3⤵
          PID:4904
      • C:\Windows\system32\certutil.exe
        certutil -decode C:\Users\Admin\AppData\Roaming\here.b64 C:\Users\Admin\AppData\Roaming\here.jpg
        2⤵
        • Deobfuscate/Decode Files or Information
        PID:2436
      • C:\Windows\system32\certutil.exe
        certutil -decode C:\Users\Admin\AppData\Roaming\herei.b64 C:\Users\Admin\AppData\Roaming\here.ico
        2⤵
        • Deobfuscate/Decode Files or Information
        PID:1956
      • C:\Windows\system32\reg.exe
        reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\here.jpg" /f
        2⤵
        • Sets desktop wallpaper using registry
        PID:2728
      • C:\Windows\system32\rundll32.exe
        RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
        2⤵
          PID:2900
        • C:\Windows\system32\timeout.exe
          timeout /t 1
          2⤵
          • Delays execution with timeout.exe
          PID:580
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im explorer.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5276
        • C:\Windows\explorer.exe
          explorer.exe
          2⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:4272
        • C:\Windows\system32\Robocopy.exe
          robocopy "C:\Users\Admin\Desktop" "C:\Users\Admin\AppData\Roaming\System Profiling\Here\Not\ok\unknown\why\yeah\itsfine\ok\here" /E /MOV
          2⤵
          • Drops desktop.ini file(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:2620
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -WindowStyle Hidden -Command "Start-Process cmd.exe -ArgumentList '/c C:\Users\Admin\AppData\Roaming\hereia.bat' -WindowStyle Hidden"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3236
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Roaming\hereia.bat
            3⤵
              PID:5908
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:952
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2772
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4936
          • C:\Windows\explorer.exe
            explorer.exe /LOADSAVEDWINDOWS
            2⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:2604
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:3048
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:1592

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              IconCache.db
              • Path C:\Users\Admin\AppData\Local\IconCache.db
              • Size 21KB
              • SHA256 5b750f1f37e0d483b3c768748eb36311355eeebfadc67ab4af83d270e43bb3b8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DiscoverCacheData.dat
              • Path C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
              • Size 1016B
              • SHA256 ca61d04b01a9926bcae5947db27f62de8d4741a8c6e2f9cfbd65feec45f267f6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              start2.bin
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\start2.bin
              • Size 3KB
              • SHA256 2721d9b447a176bff6b3db0d0d370cec198de228aa9cc38505d33e8157cb9667
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              prep_Activatable Class_Hermes_perf.cache
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
              • Size 591B
              • SHA256 dc216c11d6381abdcb6a4b927fd9ea68d336ff63c88639e4a242acf037f90c68
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              prep_Activatable Class_Hermes_perf.cache
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
              • Size 599B
              • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              prep_Activatable Class_Hermes_perf.cache
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
              • Size 595B
              • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              microsoftwindows.client[1].xml
              • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\4BEFHY7B\microsoftwindows.client[1].xml
              • Size 96B
              • SHA256 a796eda5e85fdf925ad013b44511612fa144e22052e2efe5c45cbb628b518822
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              here.b64
              • Path C:\Users\Admin\AppData\Roaming\here.b64
              • Size 2KB
              • SHA256 93e8565fb026cfb19c1b37b1a891c37f5acce8d70fc17cb43288bf460bd341a9
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              here.ico
              • Path C:\Users\Admin\AppData\Roaming\here.ico
              • Size 4KB
              • SHA256 8c177158325d1fe78ad059a80f76187e11c9ae48cd8e6cc55c2cb555b432d8a1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              here.jpg
              • Path C:\Users\Admin\AppData\Roaming\here.jpg
              • Size 1KB
              • SHA256 837ba025dc423afbcbb3dc2247d932cd1d258a7452ae43ba3a3d78fea730682f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              herei.b64
              • Path C:\Users\Admin\AppData\Roaming\herei.b64
              • Size 5KB
              • SHA256 7e6d435328450f188359a2878f1a750d10b6b24a199f9a8fef7153301546cec2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              hereia.bat
              • Path C:\Users\Admin\AppData\Roaming\hereia.bat
              • Size 4KB
              • SHA256 677100368b02e7e931f4752c7b8fd053832c72783e5baafc74191598076a5f2e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/952-23-0x000001EC03920000-0x000001EC03940000-memory.dmp
              Download

              memory/952-16-0x000001EC001E0000-0x000001EC002E0000-memory.dmp
              Download

              memory/952-24-0x000001EC13E80000-0x000001EC13F80000-memory.dmp
              Download

              memory/952-45-0x000001EC03C80000-0x000001EC03CA0000-memory.dmp
              Download

              memory/952-61-0x000001EC142C0000-0x000001EC142E0000-memory.dmp
              Download

              memory/2772-192-0x0000027600150000-0x000002760024F000-memory.dmp
              Download

              memory/3048-206-0x00000222827C0000-0x00000222827E0000-memory.dmp
              Download

              memory/3048-264-0x0000022294410000-0x0000022294430000-memory.dmp
              Download

              memory/3048-207-0x0000022282C70000-0x0000022282D70000-memory.dmp
              Download

              memory/3048-198-0x0000022280000000-0x0000022280100000-memory.dmp
              Download

              memory/3048-244-0x0000022282A00000-0x0000022282A20000-memory.dmp
              Download

              memory/3236-10-0x00000163F5060000-0x00000163F5082000-memory.dmp
              Download

              memory/4272-189-0x0000000003940000-0x0000000003941000-memory.dmp
              Download