73746204b2f0e2613699997cd49d00deb096f8680e2504961fd284fddef1d8ab

Analysis

user interaction
yes
max time kernel
34s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
testBAD.bat
Size 1KB
Sample260720-2cfcvsfz2p
SHA256 73746204b2f0e2613699997cd49d00deb096f8680e2504961fd284fddef1d8ab
MD5 d33ad5e5aa0916adf70e1d59ad3e921c
SHA1 990c70cd182c87ec14ad917dd881eb2969e8001c
SHA512 0b64fbda2a089f1f57edf8f387c408b35d4af719c0ab1ea986407fd0e3627cb070b187a6b49cf7c3eea109f138d7a1b8539aea856b137cb3455fc01d5fb3c938
TLSH
T16321377F7153B20805E465D2A9BE0A9EE90E615B236EF6143541F16D313B35C259EC0C
MD5 SHA1 SHA512 TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2364	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4640	timeout.exe
1080	timeout.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 4640	2364	cmd.exe	88
PID 2364 wrote to memory of 4404	2364	cmd.exe	89
PID 2364 wrote to memory of 1080	2364	cmd.exe	90

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4404	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\testBAD.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:4640
- C:\Windows\system32\attrib.exe
  attrib +h "C:\Users\Admin\AppData\Roaming\Local\IC3P3AK_Vault"
  2⤵
  - Views/modifies file attributes
  PID:4404
- C:\Windows\system32\timeout.exe
  timeout /t 3
  2⤵
  - Delays execution with timeout.exe
  PID:1080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads