ce93f73768894b952e10de3cd6dc179deb52ea5bb76321f866f2e5e29a04e84e

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 16:20

Target
RUN ME TO SPOOF.bat
Size 1KB
Sample260727-ts7s2shr5t
SHA256 ce93f73768894b952e10de3cd6dc179deb52ea5bb76321f866f2e5e29a04e84e
MD5 c369105e28e5a7fa94bb5252a728b9a6
SHA1 a736357e86745fe02623ed464d607a6ad8c04db6
SHA512 1c028dbebd83efadbe880eaea45771d94faad3dd97604339a28a4d388f8212d086ce9017f27c0d9821c5cadeb5e2861aa1dd955975c8dd87dded98bf4981ae32
TLSH
T14B31121A1E8BC66225F0D8A8E3111541F70BE20B691849D0F9A150B46E5A180ABFDAEC
MD5 SHA1 SHA512 TLSH

Score

8^/10

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

Registry Run Keys / Startup Folder

Modify Registry

Windows Service

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\zbWYKUXtdaUkICLacpZlGtRyl\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\zbWYKUXtdaUkICLacpZlGtRyl"	catmapper.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
4076	cmd.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
3872	taskkill.exe
4744	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3420	catmapper.exe
3420	catmapper.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3420	catmapper.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3420	catmapper.exe
Token: SeLoadDriverPrivilege	3420	catmapper.exe
Token: SeDebugPrivilege	3872	taskkill.exe
Token: SeDebugPrivilege	4744	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 2584	4076	cmd.exe	89
PID 4076 wrote to memory of 3420	4076	cmd.exe	91
PID 4076 wrote to memory of 3872	4076	cmd.exe	92
PID 4076 wrote to memory of 4744	4076	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RUN ME TO SPOOF.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:2584
- C:\Users\Admin\AppData\Local\Temp\Items\catmapper.exe
  CatMapper.exe --free "cat.sys"
  2⤵
  - Sets service image path in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:3420
- C:\Windows\system32\taskkill.exe
  taskkill /im wmiprv* /f /t
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3872
- C:\Windows\system32\taskkill.exe
  taskkill /im wmiprv* /f /t
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4744