ab60ec1bf1a2f9afdab0acb53f821a98b88298ed9f3fbba0b903a1c2ab31afc2

Analysis

max time kernel
899s
max time network
819s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 00:59

Target
general (ALT).bat
Size 2KB
Sample260712-bb5m9ady71
SHA256 ab60ec1bf1a2f9afdab0acb53f821a98b88298ed9f3fbba0b903a1c2ab31afc2
MD5 13efb6478ce796a894804ec296b9d04b
SHA1 03f3bebcbcbdfd962051405fe787dc8812965937
SHA512 3e1f1c32ff9aea9d6e67fef1f8636e253d665e5a47ed3acc13dae8de336f04c02eccf8ec3f42ded18d92062c9fe1487dfa78c1380053e197dcd30f6b02a93468
TLSH
T1345148A7E00CCA47F2CEA53EF46FB5607127DCC369D6D802834A59F8DC4EDA9684E494
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5840 wrote to memory of 252	5840	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\general (ALT).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5840
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:896

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6168

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact