Analysis
- max time kernel
80s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 16:14
General
- Target HardwareRape.bat
- Size 3KB
- Sample260718-tp4bfsft9p
- SHA256 30b3fff31bdf0205d23c2c6cf031637668fafb4bfce77e99901d090dd71b62bf
Malware Config
Signatures
- Possible privilege escalation attempt 2 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Delays execution with timeout.exe 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\HardwareRape.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con: cols=80 lines=302⤵
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak2⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\Windows\System32" /r /d y2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32" /grant Everyone:F /t2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\timeout.exetimeout /t 52⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\shutdown.exeshutdown2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2628-10011-0x00007FF9E6080000-0x00007FF9E60AA000-memory.dmp
memory/2628-10009-0x00007FF9E5650000-0x00007FF9E5717000-memory.dmp
memory/2628-10012-0x00007FF9E66E0000-0x00007FF9E6754000-memory.dmp
memory/2628-10013-0x00007FF9E6380000-0x00007FF9E6429000-memory.dmp
memory/2628-10008-0x00007FF9E67A0000-0x00007FF9E6A03000-memory.dmp
memory/2628-10010-0x00007FF9E6500000-0x00007FF9E66C3000-memory.dmp
memory/3532-10022-0x00007FF9E67A0000-0x00007FF9E6A03000-memory.dmp
memory/3532-10021-0x00007FF6074E0000-0x00007FF60754F000-memory.dmp
memory/3532-10003-0x00007FF9E6380000-0x00007FF9E6429000-memory.dmp
memory/3532-10001-0x00007FF9E67A0000-0x00007FF9E6A03000-memory.dmp
memory/3532-10007-0x00007FF9E6080000-0x00007FF9E60AA000-memory.dmp
memory/3532-10005-0x00007FF9E4200000-0x00007FF9E4376000-memory.dmp
memory/3532-10006-0x00007FF9E6500000-0x00007FF9E66C3000-memory.dmp
memory/3532-10002-0x00007FF9E5650000-0x00007FF9E5717000-memory.dmp
memory/3532-10025-0x00007FF9E6260000-0x00007FF9E6312000-memory.dmp
memory/3532-10028-0x00007FF9E6080000-0x00007FF9E60AA000-memory.dmp
memory/3532-10004-0x00007FF9E6260000-0x00007FF9E6312000-memory.dmp
memory/3532-10000-0x00007FF6074E0000-0x00007FF60754F000-memory.dmp
memory/3532-10024-0x00007FF9E6380000-0x00007FF9E6429000-memory.dmp
memory/3532-10027-0x00007FF9E6500000-0x00007FF9E66C3000-memory.dmp
memory/3532-10026-0x00007FF9E4200000-0x00007FF9E4376000-memory.dmp
memory/3588-10020-0x00007FF9E6500000-0x00007FF9E66C3000-memory.dmp
memory/3588-10017-0x00007FF9E6260000-0x00007FF9E6312000-memory.dmp
memory/3588-10019-0x00007FF9E6080000-0x00007FF9E60AA000-memory.dmp
memory/3588-10018-0x00007FF9E5EE0000-0x00007FF9E6079000-memory.dmp
memory/3588-10015-0x00007FF9E5650000-0x00007FF9E5717000-memory.dmp
memory/3588-10016-0x00007FF9E6380000-0x00007FF9E6429000-memory.dmp
memory/3588-10014-0x00007FF9E67A0000-0x00007FF9E6A03000-memory.dmp