Overview

overview

6

Static

static

1

sleep method.bat

windows10-2004-x64

6

sleep method.bat

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    12s
  • max time network
    14s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/07/2026, 18:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sleep method.bat
  • Size 792B
  • Sample260720-w7e3padt4t
  • SHA256 05ca42989badcbfb5d3296201bce5abbc9b23370bfb305ab367d60a509db4d25
  • MD5 SHA1 SHA512 TLSH
Score
6/10
execution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\sleep method.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:3816
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "try { [DateTime]$d = '1601-01-01'; $win32 = Add-Type -Name 'Kernel32' -Namespace 'Win32' -MemberDefinition '[DllImport(\"kernel32.dll\",SetLastError=true)] public static extern bool SetSystemTime(ref SystemTime st); [StructLayout(LayoutKind.Sequential)] public struct SystemTime { public ushort Year; public ushort Month; public ushort DayOfWeek; public ushort Day; public ushort Hour; public ushort Minute; public ushort Second; public ushort Milliseconds; }' -PassThru; $st = New-Object Win32.Kernel32+SystemTime; $st.Year = 1601; $st.Month = 1; $st.Day = 1; $st.Hour = 0; $st.Minute = 0; $st.Second = 0; [Win32.Kernel32]::SetSystemTime([ref]$st) } catch {}"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4024
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j1baowkg\j1baowkg.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1812
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6378.tmp" "c:\Users\Admin\AppData\Local\Temp\j1baowkg\CSC7E19B99F4CE24DC19C8F4D66AAAB551.TMP"
          4⤵
            PID:1580
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa395f055 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:1052

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          RES6378.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\RES6378.tmp
          • Size 1KB
          • SHA256 97f1d351322a7e4f9a75a8c277f0bed2f7e0c283be88c4b2409f4000e81388c8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_gm4r4s0o.bf0.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gm4r4s0o.bf0.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          j1baowkg.dll
          • Path C:\Users\Admin\AppData\Local\Temp\j1baowkg\j1baowkg.dll
          • Size 3KB
          • SHA256 c2e647ef0427ef837a100ef21cb200b1a23ddf3a40d12255dd0a819360f05105
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          CSC7E19B99F4CE24DC19C8F4D66AAAB551.TMP
          • Path \??\c:\Users\Admin\AppData\Local\Temp\j1baowkg\CSC7E19B99F4CE24DC19C8F4D66AAAB551.TMP
          • Size 652B
          • SHA256 f4c56c52ffc8f8e4513e6a76d12b5e075d045b99cff895b5c04f1fddead31d9b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          j1baowkg.0.cs
          • Path \??\c:\Users\Admin\AppData\Local\Temp\j1baowkg\j1baowkg.0.cs
          • Size 470B
          • SHA256 98ff1485d003964fafa5c8a0cf9b7affdf362f5a6d8516660eb25f7d652856d8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          j1baowkg.cmdline
          • Path \??\c:\Users\Admin\AppData\Local\Temp\j1baowkg\j1baowkg.cmdline
          • Size 369B
          • SHA256 2711979b930038f97ef88dfc6dad242fae730d9ce8ec0dae99c7c6520a3ee428
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/4024-0-0x000002236B5E0000-0x000002236B5F0000-memory.dmp
          Download

          memory/4024-1-0x000002236B5E0000-0x000002236B5F0000-memory.dmp
          Download

          memory/4024-8-0x000002236B5A0000-0x000002236B5C2000-memory.dmp
          Download

          memory/4024-22-0x000002236B5D0000-0x000002236B5D8000-memory.dmp
          Download