Analysis
- user interaction
yes - max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 05:41
Static task
static1
Behavioral task
behavioral1
Sample
sys32del.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
sys32del.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target sys32del.bat
- Size 652B
- Sample260731-gdt77avend
- SHA256 651a38b1f798719c5e9960d1b0943cf0663f23ddbff15ff8decac14049b6daaa
- MD5 92235353fb8fbcb5ab064fd741b0ecad
- SHA1 277a714fbc377fb3176d29fa740077ae9836fac0
- SHA512 a511aec77b0dd8e2375218af1c4693aa4939a1610b91f456e97e572f5a9e3041d56feb350668f46225d3928298c434243a7c4d45b4fffce4c06a06924d8a91de
- TLSH T1BCF09E29335B1E3900419997C819A6D5A934B77982951A11B2DA38E0E64F1D86732F78
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2484 cmd.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5460 Taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5460 Taskmgr.exe Token: SeSystemProfilePrivilege 5460 Taskmgr.exe Token: SeCreateGlobalPrivilege 5460 Taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe 5460 Taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5460 Taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2484 wrote to memory of 5460 2484 cmd.exe 90
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\sys32del.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\system32\Taskmgr.exetaskmgr2⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5460
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3148