ce93f73768894b952e10de3cd6dc179deb52ea5bb76321f866f2e5e29a04e84e

Analysis

user interaction
yes
max time kernel
76s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 16:20

Target
RUN ME TO SPOOF.bat
Size 1KB
Sample260727-ts7s2shr5t
SHA256 ce93f73768894b952e10de3cd6dc179deb52ea5bb76321f866f2e5e29a04e84e
MD5 c369105e28e5a7fa94bb5252a728b9a6
SHA1 a736357e86745fe02623ed464d607a6ad8c04db6
SHA512 1c028dbebd83efadbe880eaea45771d94faad3dd97604339a28a4d388f8212d086ce9017f27c0d9821c5cadeb5e2861aa1dd955975c8dd87dded98bf4981ae32
TLSH
T14B31121A1E8BC66225F0D8A8E3111541F70BE20B691849D0F9A150B46E5A180ABFDAEC
MD5 SHA1 SHA512 TLSH

Score

8^/10

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

Registry Run Keys / Startup Folder

Modify Registry

Windows Service

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ercznSAlKjcVCF\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\ercznSAlKjcVCF"	catmapper.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
3796	cmd.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
1488	taskkill.exe
3440	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2436	catmapper.exe
2436	catmapper.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2436	catmapper.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2436	catmapper.exe
Token: SeLoadDriverPrivilege	2436	catmapper.exe
Token: SeDebugPrivilege	1488	taskkill.exe
Token: SeDebugPrivilege	3440	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 2732	3796	cmd.exe	88
PID 3796 wrote to memory of 2436	3796	cmd.exe	89
PID 3796 wrote to memory of 1488	3796	cmd.exe	90
PID 3796 wrote to memory of 3440	3796	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RUN ME TO SPOOF.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:2732
- C:\Users\Admin\AppData\Local\Temp\Items\catmapper.exe
  CatMapper.exe --free "cat.sys"
  2⤵
  - Sets service image path in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:2436
- C:\Windows\system32\taskkill.exe
  taskkill /im wmiprv* /f /t
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1488
- C:\Windows\system32\taskkill.exe
  taskkill /im wmiprv* /f /t
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3440