d5d7fb14c2eb0dadbd9f3c6e27a64e3c4491689f8b153bd42a56a96ca861308a

Analysis

user interaction
yes
max time kernel
6s
max time network
6s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
debug.bat
Size 9KB
Sample260728-mcdrpsgf48
SHA256 d5d7fb14c2eb0dadbd9f3c6e27a64e3c4491689f8b153bd42a56a96ca861308a
MD5 b6755c0b0bafee6baeed1848f73e3aa3
SHA1 9b11ee83cc6d2b1a5a1b5225ff53ff4c5dcc5397
SHA512 19fed7a738b033f2f4cc0fa61162d30268b22e4ab65c8d2ab4f129c23814177b098348f1739106a677849ea679c356e08cfd91aff5e26eb015a9f340ff32a588
SSDEEP 192:Lk6YSNqNVNZqMw+WxSK8S4YofjIhGU2CrUmCeiNdFDfA//f0snG515k5Npx8odrF:LzYSNqNVNZqMwJxSK8S4YofjIhGU2Crf
TLSH
T1B5123B317D051D7DCD86E2B47AA70441FB72114325167FD1BBDA209E20E798A863CEEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5048	cmd.exe

Runs net.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 6600	5048	cmd.exe	90
PID 6600 wrote to memory of 4744	6600	net.exe	91
PID 5048 wrote to memory of 1696	5048	cmd.exe	92
PID 5048 wrote to memory of 5956	5048	cmd.exe	93
PID 5048 wrote to memory of 6568	5048	cmd.exe	94
PID 5048 wrote to memory of 6932	5048	cmd.exe	95
PID 5048 wrote to memory of 6888	5048	cmd.exe	96
PID 5048 wrote to memory of 5272	5048	cmd.exe	97
PID 5048 wrote to memory of 4492	5048	cmd.exe	98
PID 5048 wrote to memory of 1744	5048	cmd.exe	99
PID 5048 wrote to memory of 980	5048	cmd.exe	100
PID 5048 wrote to memory of 3012	5048	cmd.exe	101
PID 5048 wrote to memory of 5488	5048	cmd.exe	102
PID 5048 wrote to memory of 1864	5048	cmd.exe	103
PID 5048 wrote to memory of 6732	5048	cmd.exe	104
PID 5048 wrote to memory of 6284	5048	cmd.exe	105
PID 5048 wrote to memory of 5312	5048	cmd.exe	106
PID 5048 wrote to memory of 4252	5048	cmd.exe	107
PID 5048 wrote to memory of 4844	5048	cmd.exe	108
PID 5048 wrote to memory of 3416	5048	cmd.exe	109
PID 5048 wrote to memory of 5492	5048	cmd.exe	110
PID 5048 wrote to memory of 7096	5048	cmd.exe	111
PID 5048 wrote to memory of 556	5048	cmd.exe	112
PID 5048 wrote to memory of 4240	5048	cmd.exe	113
PID 5048 wrote to memory of 4712	5048	cmd.exe	114
PID 5048 wrote to memory of 5028	5048	cmd.exe	115
PID 5048 wrote to memory of 948	5048	cmd.exe	116
PID 5048 wrote to memory of 6232	5048	cmd.exe	117
PID 5048 wrote to memory of 3904	5048	cmd.exe	118
PID 5048 wrote to memory of 1836	5048	cmd.exe	119
PID 5048 wrote to memory of 3868	5048	cmd.exe	120
PID 5048 wrote to memory of 4908	5048	cmd.exe	121
PID 5048 wrote to memory of 4952	5048	cmd.exe	122
PID 5048 wrote to memory of 3268	5048	cmd.exe	123
PID 5048 wrote to memory of 3924	5048	cmd.exe	124
PID 5048 wrote to memory of 360	5048	cmd.exe	125
PID 5048 wrote to memory of 6784	5048	cmd.exe	126
PID 5048 wrote to memory of 3272	5048	cmd.exe	127
PID 5048 wrote to memory of 4796	5048	cmd.exe	128
PID 5048 wrote to memory of 5976	5048	cmd.exe	129
PID 5048 wrote to memory of 940	5048	cmd.exe	130
PID 5048 wrote to memory of 7100	5048	cmd.exe	131
PID 5048 wrote to memory of 5692	5048	cmd.exe	132
PID 5048 wrote to memory of 3384	5048	cmd.exe	133
PID 5048 wrote to memory of 4248	5048	cmd.exe	134
PID 5048 wrote to memory of 1296	5048	cmd.exe	135
PID 5048 wrote to memory of 4308	5048	cmd.exe	136
PID 5048 wrote to memory of 3044	5048	cmd.exe	137
PID 5048 wrote to memory of 2656	5048	cmd.exe	138
PID 5048 wrote to memory of 2344	5048	cmd.exe	139
PID 5048 wrote to memory of 7124	5048	cmd.exe	140
PID 5048 wrote to memory of 2540	5048	cmd.exe	141
PID 5048 wrote to memory of 6148	5048	cmd.exe	142
PID 5048 wrote to memory of 1912	5048	cmd.exe	143
PID 5048 wrote to memory of 3380	5048	cmd.exe	144
PID 5048 wrote to memory of 5180	5048	cmd.exe	145
PID 5048 wrote to memory of 4708	5048	cmd.exe	146
PID 5048 wrote to memory of 4692	5048	cmd.exe	147
PID 5048 wrote to memory of 6376	5048	cmd.exe	148
PID 5048 wrote to memory of 5448	5048	cmd.exe	149
PID 5048 wrote to memory of 5464	5048	cmd.exe	150
PID 5048 wrote to memory of 5800	5048	cmd.exe	151
PID 5048 wrote to memory of 2856	5048	cmd.exe	152
PID 5048 wrote to memory of 6964	5048	cmd.exe	153

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\debug.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6600
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4744
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\NVIDIA Corporation\Global\GFExperience" /v "NotifyNewDisplayUpdates" /t REG_DWORD /d 0 /f
  2⤵
  PID:1696
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\NVIDIA Corporation\NvTray" /v "StartOnLogin" /t REG_DWORD /d 0 /f
  2⤵
  PID:5956
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\NVTweak" /v "HideXGpuTrayIcon" /t REG_DWORD /d 1 /f
  2⤵
  PID:6568
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\NVIDIA Corporation\Global\CoProcManager" /v "ShowTrayIcon" /t REG_DWORD /d 0 /f
  2⤵
  PID:6932
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\NVTweak" /v "DisplayPowerSaving" /t REG_DWORD /d 0 /f
  2⤵
  PID:6888
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\NVIDIA Corporation\Global\NVTweak" /v "DisplayPowerSaving" /t REG_DWORD /d 0 /f
  2⤵
  PID:5272
- C:\Windows\system32\reg.exe
  reg add "" /v "EnableRuntimePowerManagement" /t REG_DWORD /d 0 /f
  2⤵
  PID:4492
- C:\Windows\system32\reg.exe
  reg add "" /v "RmProfilingAdminOnly" /t REG_DWORD /d 0 /f
  2⤵
  PID:1744
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm\Global\NVTweak" /v "RmProfilingAdminOnly" /t REG_DWORD /d 0 /f
  2⤵
  PID:980
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\Dwm" /v "OverlayTestMode" /t REG_DWORD /d 5 /f
  2⤵
  PID:3012
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\NVIDIA Corporation\Global\NGXCore" /v "ShowDlssIndicator" /t REG_DWORD /d 0 /f
  2⤵
  PID:5488
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm" /v "EnableHDAudioD3Cold" /t REG_DWORD /d 0 /f
  2⤵
  PID:1864
- C:\Windows\system32\reg.exe
  reg add "" /v "RmDisableHwFaultBuffer" /t REG_DWORD /d 1 /f
  2⤵
  PID:6732
- C:\Windows\system32\reg.exe
  reg add "" /v "RMDisablePerIntrDPCQueueing" /t REG_DWORD /d 1 /f
  2⤵
  PID:6284
- C:\Windows\system32\reg.exe
  reg add "" /v "RMElcg" /t REG_DWORD /d 1431655765 /f
  2⤵
  PID:5312
- C:\Windows\system32\reg.exe
  reg add "" /v "RMBlcg" /t REG_DWORD /d 286331153 /f
  2⤵
  PID:4252
- C:\Windows\system32\reg.exe
  reg add "" /v "RMElpg" /t REG_DWORD /d 4095 /f
  2⤵
  PID:4844
- C:\Windows\system32\reg.exe
  reg add "" /v "RMSlcg" /t REG_DWORD /d 262131 /f
  2⤵
  PID:3416
- C:\Windows\system32\reg.exe
  reg add "" /v "RMFspg" /t REG_DWORD /d 15 /f
  2⤵
  PID:5492
- C:\Windows\system32\reg.exe
  reg add "" /v "RMGC6Feature" /t REG_DWORD /d 699050 /f
  2⤵
  PID:7096
- C:\Windows\system32\reg.exe
  reg add "" /v "RMGC6Parameters" /t REG_DWORD /d 85 /f
  2⤵
  PID:556
- C:\Windows\system32\reg.exe
  reg add "" /v "RMDidleFeatureGC5" /t REG_DWORD /d 44731050 /f
  2⤵
  PID:4240
- C:\Windows\system32\reg.exe
  reg add "" /v "RMHotPlugSupportDisable" /t REG_DWORD /d 1 /f
  2⤵
  PID:4712
- C:\Windows\system32\reg.exe
  reg add "" /v "RmFbsrPagedDMA" /t REG_DWORD /d 1 /f
  2⤵
  PID:5028
- C:\Windows\system32\reg.exe
  reg add "" /v "RMDisablePostL2Compression" /t REG_DWORD /d 1 /f
  2⤵
  PID:948
- C:\Windows\system32\reg.exe
  reg add "" /v "RmRcWatchdog" /t REG_DWORD /d 0 /f
  2⤵
  PID:6232
- C:\Windows\system32\reg.exe
  reg add "" /v "RmLogonRC" /t REG_DWORD /d 0 /f
  2⤵
  PID:3904
- C:\Windows\system32\reg.exe
  reg add "" /v "RMIntrDetailedLogs" /t REG_DWORD /d 0 /f
  2⤵
  PID:1836
- C:\Windows\system32\reg.exe
  reg add "" /v "RMCtxswLog" /t REG_DWORD /d 0 /f
  2⤵
  PID:3868
- C:\Windows\system32\reg.exe
  reg add "" /v "RMNvLog" /t REG_DWORD /d 0 /f
  2⤵
  PID:4908
- C:\Windows\system32\reg.exe
  reg add "" /v "RMSuppressGPIOIntrErrLog" /t REG_DWORD /d 0 /f
  2⤵
  PID:4952
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm\Parameters" /v "LogDisableMasks" /t REG_BINARY /d "ffffffff" /f
  2⤵
  PID:3268
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm\Parameters" /v "LogWarningEntries" /t REG_DWORD /d 0 /f
  2⤵
  PID:3924
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm\Parameters" /v "LogPagingEntries" /t REG_DWORD /d 0 /f
  2⤵
  PID:360
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm\Parameters" /v "LogEventEntries" /t REG_DWORD /d 0 /f
  2⤵
  PID:6784
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm\Parameters" /v "LogErrorEntries" /t REG_DWORD /d 0 /f
  2⤵
  PID:3272
- C:\Windows\system32\reg.exe
  reg add "" /v "RMUsbcDebugMode" /t REG_DWORD /d 0 /f
  2⤵
  PID:4796
- C:\Windows\system32\reg.exe
  reg add "" /v "RMDisableFeatureDisablement" /t REG_DWORD /d 0 /f
  2⤵
  PID:5976
- C:\Windows\system32\reg.exe
  reg add "" /v "RmBreakonRC" /t REG_DWORD /d 0 /f
  2⤵
  PID:940
- C:\Windows\system32\reg.exe
  reg add "" /v "RmEnableI2CNanny" /t REG_DWORD /d 0 /f
  2⤵
  PID:7100
- C:\Windows\system32\reg.exe
  reg add "" /v "RMPcieLtrOverride" /t REG_DWORD /d 1 /f
  2⤵
  PID:5692
- C:\Windows\system32\reg.exe
  reg add "" /v "RMPcieLtrL12ThresholdOverride" /t REG_DWORD /d 0 /f
  2⤵
  PID:3384
- C:\Windows\system32\reg.exe
  reg add "" /v "RMDeepL1EntryLatencyUsec" /t REG_DWORD /d 1 /f
  2⤵
  PID:4248
- C:\Windows\system32\reg.exe
  reg add "" /v "RmPerfLimitsOverride" /t REG_DWORD /d 21 /f
  2⤵
  PID:1296
- C:\Windows\system32\reg.exe
  reg add "" /v "RMGCOffFeature" /t REG_DWORD /d 2 /f
  2⤵
  PID:4308
- C:\Windows\system32\reg.exe
  reg add "" /v "RmOverrideSupportChipsetAspm" /t REG_DWORD /d 1 /f
  2⤵
  PID:3044
- C:\Windows\system32\reg.exe
  reg add "" /v "RMEnableASPMDT" /t REG_DWORD /d 1 /f
  2⤵
  PID:2656
- C:\Windows\system32\reg.exe
  reg add "" /v "RMDisableGpuASPMFlags" /t REG_DWORD /d 3 /f
  2⤵
  PID:2344
- C:\Windows\system32\reg.exe
  reg add "" /v "RMEnableASPMAtLoad" /t REG_DWORD /d 0 /f
  2⤵
  PID:7124
- C:\Windows\system32\reg.exe
  reg add "" /v "RMEnableEventTracer" /t REG_DWORD /d 0 /f
  2⤵
  PID:2540
- C:\Windows\system32\reg.exe
  reg add "" /v "SkipSwStateErrChecks" /t REG_DWORD /d 1 /f
  2⤵
  PID:6148
- C:\Windows\system32\reg.exe
  reg add "" /v "RMAERRForceDisable" /t REG_DWORD /d 1 /f
  2⤵
  PID:1912
- C:\Windows\system32\reg.exe
  reg add "" /v "RM580312" /t REG_DWORD /d 1 /f
  2⤵
  PID:3380
- C:\Windows\system32\reg.exe
  reg add "" /v "RmWar1760398" /t REG_DWORD /d 1 /f
  2⤵
  PID:5180
- C:\Windows\system32\reg.exe
  reg add "" /v "RMLpwrArch" /t REG_DWORD /d 349525 /f
  2⤵
  PID:4708
- C:\Windows\system32\reg.exe
  reg add "" /v "RmLpwrGrPgSwFilterFunction" /t REG_DWORD /d 0 /f
  2⤵
  PID:4692
- C:\Windows\system32\reg.exe
  reg add "" /v "RmLpwrCtrlMsDifrSwAsrParameters" /t REG_DWORD /d 5461 /f
  2⤵
  PID:6376
- C:\Windows\system32\reg.exe
  reg add "" /v "RmLpwrCacheStatsOnD3" /t REG_DWORD /d 0 /f
  2⤵
  PID:5448
- C:\Windows\system32\reg.exe
  reg add "" /v "RmPgCtrlParameters" /t REG_DWORD /d 1431655765 /f
  2⤵
  PID:5464
- C:\Windows\system32\reg.exe
  reg add "" /v "RmDwbMscg" /t REG_DWORD /d 1 /f
  2⤵
  PID:5800
- C:\Windows\system32\reg.exe
  reg add "" /v "RmDisableInforomBBX" /t REG_DWORD /d 15 /f
  2⤵
  PID:2856
- C:\Windows\system32\reg.exe
  reg add "" /v "PreferSystemMemoryContiguous" /t REG_DWORD /d 1 /f
  2⤵
  PID:6964
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\nvlddmkm" /v "PreferSystemMemoryContiguous" /t REG_DWORD /d 1 /f
  2⤵
  PID:6552
- C:\Windows\system32\reg.exe
  reg add "" /v "RmSec2EnableApm" /t REG_DWORD /d 0 /f
  2⤵
  PID:4260
- C:\Windows\system32\reg.exe
  reg add "" /v "RmOverrideIdleSlowdownSettings" /t REG_DWORD /d 0 /f
  2⤵
  PID:6776
- C:\Windows\system32\reg.exe
  reg add "" /v "RMClkSlowDown" /t REG_DWORD /d 71303168 /f
  2⤵
  PID:2940
- C:\Windows\system32\reg.exe
  reg add "" /v "RM2644249" /t REG_DWORD /d 1 /f
  2⤵
  PID:3524
- C:\Windows\system32\reg.exe
  reg add "" /v "RmDisableACPI" /t REG_DWORD /d 1023 /f
  2⤵
  PID:4540
- C:\Windows\system32\reg.exe
  reg add "" /v "RMNativePcieL1WarFlags" /t REG_DWORD /d 16 /f
  2⤵
  PID:7092
- C:\Windows\system32\reg.exe
  reg add "" /v "RMResetPerfMonD4" /t REG_DWORD /d 0 /f
  2⤵
  PID:3408
- C:\Windows\system32\reg.exe
  reg add "" /v "RmFbsrWDDMMode" /t REG_DWORD /d 0 /f
  2⤵
  PID:4736
- C:\Windows\system32\reg.exe
  reg add "" /v "PerfLevelSrc" /t REG_DWORD /d 8738 /f
  2⤵
  PID:6520
- C:\Windows\system32\reg.exe
  reg add "" /v "RMElpgStateOnInit" /t REG_DWORD /d 3 /f
  2⤵
  PID:2352
- C:\Windows\system32\reg.exe
  reg add "" /v "RmMIONoPowerOff" /t REG_DWORD /d 1 /f
  2⤵
  PID:2424
- C:\Windows\system32\reg.exe
  reg add "" /v "RMDisableOptimalPowerForPadlinkPll" /t REG_DWORD /d 1 /f
  2⤵
  PID:3280
- C:\Windows\system32\reg.exe
  reg add "" /v "RmClkPowerOffDramPllWhenUnused" /t REG_DWORD /d 0 /f
  2⤵
  PID:716
- C:\Windows\system32\reg.exe
  reg add "" /v "RMOPSB" /t REG_DWORD /d 10914 /f
  2⤵
  PID:7064
- C:\Windows\system32\reg.exe
  reg add "" /v "DisableDynamicPstate" /t REG_DWORD /d 1 /f
  2⤵
  PID:2684
- C:\Windows\system32\reg.exe
  reg add "" /v "DisableAsyncPstates" /t REG_DWORD /d 1 /f
  2⤵
  PID:7072
- C:\Windows\system32\reg.exe
  reg add "" /v "RMNvlinkUPHYInitControl" /t REG_DWORD /d 16 /f
  2⤵
  PID:6472
- C:\Windows\system32\reg.exe
  reg add "" /v "RmGpsGenoa" /t REG_DWORD /d 0 /f
  2⤵
  PID:2704
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Nvidia Corporation\NvControlPanel2\Client" /v "OptInOrOutPreference" /t REG_DWORD /d 0 /f
  2⤵
  PID:1428
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\nvlddmkm\Global\Startup" /v "SendTelemetryData" /t REG_DWORD /d 0 /f
  2⤵
  PID:5484
- C:\Windows\system32\reg.exe
  reg add "" /v "RmDisableRegistryCaching" /t REG_DWORD /d 15 /f
  2⤵
  PID:5340
- C:\Windows\system32\reg.exe
  reg add "" /v "D3PCLatency" /t REG_DWORD /d 1 /f
  2⤵
  PID:5632
- C:\Windows\system32\reg.exe
  reg add "" /v "EnableMsHybrid" /t REG_DWORD /d 0 /f
  2⤵
  PID:2364
- C:\Windows\system32\reg.exe
  reg add "" /v "RMDisableIntrIllegalCompstatAccess" /t REG_DWORD /d 1 /f
  2⤵
  PID:2064
- C:\Windows\system32\reg.exe
  reg add "" /v "SetPanelRefreshRate" /t REG_DWORD /d 0 /f
  2⤵
  PID:4700
- C:\Windows\system32\reg.exe
  reg add "" /v "RMDisableNoncontigAlloc" /t REG_DWORD /d 1 /f
  2⤵
  PID:5732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads