Analysis
- user interaction
yes - max time kernel
139s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
18/07/2026, 16:14
General
- Target HardwareRape.bat
- Size 3KB
- Sample260718-tp4bfsft9p
- SHA256 30b3fff31bdf0205d23c2c6cf031637668fafb4bfce77e99901d090dd71b62bf
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Possible privilege escalation attempt 2 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 2 IoCs
- Modifies registry class 13 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 10 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\HardwareRape.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con: cols=80 lines=302⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak2⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32" /r /d y2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32" /grant Everyone:F /t2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\timeout.exetimeout /t 52⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\shutdown.exeshutdown2⤵
-
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\86b9a77a9525424d8043da4287f30d64 /t 3284 /p 32801⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DUMMY_1.TXT
DUMMY_10.TXT
DUMMY_11.TXT
DUMMY_12.TXT
DUMMY_13.TXT
DUMMY_14.TXT
DUMMY_15.TXT
DUMMY_16.TXT
DUMMY_17.TXT
DUMMY_18.TXT
DUMMY_19.TXT
DUMMY_2.TXT
DUMMY_20.TXT
DUMMY_21.TXT
DUMMY_22.TXT
DUMMY_23.TXT
DUMMY_24.TXT
DUMMY_25.TXT
DUMMY_26.TXT
DUMMY_27.TXT
DUMMY_28.TXT
DUMMY_29.TXT
DUMMY_3.TXT
DUMMY_30.TXT
DUMMY_31.TXT
DUMMY_32.TXT
DUMMY_33.TXT
DUMMY_34.TXT
DUMMY_35.TXT
DUMMY_36.TXT
DUMMY_37.TXT
DUMMY_38.TXT
DUMMY_39.TXT
DUMMY_4.TXT
DUMMY_40.TXT
DUMMY_41.TXT
DUMMY_42.TXT
DUMMY_43.TXT
DUMMY_44.TXT
DUMMY_45.TXT
DUMMY_46.TXT
DUMMY_47.TXT
DUMMY_48.TXT
DUMMY_49.TXT
DUMMY_5.TXT
DUMMY_50.TXT
DUMMY_51.TXT
DUMMY_52.TXT
DUMMY_53.TXT
DUMMY_54.TXT
DUMMY_55.TXT
DUMMY_56.TXT
DUMMY_57.TXT
DUMMY_58.TXT
DUMMY_59.TXT
DUMMY_6.TXT
DUMMY_60.TXT
DUMMY_61.TXT
DUMMY_62.TXT
DUMMY_63.TXT
DUMMY_64.TXT
DUMMY_7.TXT
DUMMY_8.TXT
DUMMY_9.TXT
StartUnifiedTileModelCache.dat
memory/3568-10069-0x0000000002840000-0x0000000002841000-memory.dmp
memory/4388-10107-0x000001B4938E0000-0x000001B493900000-memory.dmp
memory/4388-10073-0x000001B4923B0000-0x000001B4924B0000-memory.dmp
memory/4388-10106-0x000001B4934D0000-0x000001B4934F0000-memory.dmp
memory/4388-10076-0x000001B493510000-0x000001B493530000-memory.dmp
memory/4388-10071-0x000001B4923B0000-0x000001B4924B0000-memory.dmp