09b206f1a3c97640a70c693bb52884c0c9e6c1ee921307fe1915c987fb7d64d1

Analysis

max time kernel
298s
max time network
231s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FUCK YOU NULL.bat
Size 2KB
Sample260731-pl5b5attfs
SHA256 09b206f1a3c97640a70c693bb52884c0c9e6c1ee921307fe1915c987fb7d64d1
MD5 1d2e3a5a195566a483af1981dcda79b2
SHA1 f2737038a063a53714a5a962270fce708277bc3b
SHA512 d6fba9efc8117e7a03a084447a7822ca9560ee49d08f68c9a43ecf024e3fc4af2769242bac0dcd680d591978d95e842cefc4dd44ad517d24810496c994a1ab45
TLSH
T1A951CC3F6769C6577CA161618FED8054B83A92F7F60AA812735F392C53022C0E76C9E7
MD5 SHA1 SHA512 TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 11 IoCs

execution

Visual Basic

T1059.005

pid	Process
808	wscript.exe
2152	wscript.exe
5484	wscript.exe
2000	wscript.exe
4764	wscript.exe
1492	wscript.exe
1752	wscript.exe
5820	wscript.exe
2776	wscript.exe
6132	wscript.exe
5948	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2600	cmd.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2436	notepad.exe
1108	notepad.exe
2540	notepad.exe
5716	notepad.exe
5944	notepad.exe
2824	notepad.exe
5828	notepad.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 808	2600	cmd.exe	90
PID 808 wrote to memory of 2436	808	wscript.exe	91
PID 808 wrote to memory of 2776	808	wscript.exe	92
PID 808 wrote to memory of 1108	808	wscript.exe	93
PID 808 wrote to memory of 2152	808	wscript.exe	94
PID 808 wrote to memory of 2540	808	wscript.exe	95
PID 808 wrote to memory of 5484	808	wscript.exe	96
PID 808 wrote to memory of 5716	808	wscript.exe	97
PID 808 wrote to memory of 2000	808	wscript.exe	98
PID 808 wrote to memory of 5944	808	wscript.exe	99
PID 808 wrote to memory of 6132	808	wscript.exe	100
PID 808 wrote to memory of 2824	808	wscript.exe	101
PID 808 wrote to memory of 4764	808	wscript.exe	102
PID 808 wrote to memory of 5828	808	wscript.exe	103
PID 808 wrote to memory of 5948	808	wscript.exe	104
PID 808 wrote to memory of 1492	808	wscript.exe	105
PID 808 wrote to memory of 1752	808	wscript.exe	106
PID 808 wrote to memory of 5820	808	wscript.exe	107

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FUCK YOU NULL.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\system32\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Local\Temp\null_prank.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2436
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\null_errors.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2776
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1108
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\null_errors.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2152
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2540
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\null_errors.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5484
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:5716
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\null_errors.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2000
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:5944
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\null_errors.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:6132
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2824
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\null_errors.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4764
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:5828
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\null_errors.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5948
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\null_errors.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1492
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\null_errors.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:1752
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\null_errors.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

null_errors.vbs

Path C:\Users\Admin\AppData\Local\Temp\null_errors.vbs
Size 64B
SHA256 7b204dcf037760729733e774bf372232e114de7dc3ab8fe2339e13610b012dc3
MD5 6f0c9b4604c25123aa20f9e56332922e
SHA1 0c5f80374a55f2e1d3c4a2d82a1d9458bc73e67e
SHA512 649ed8ac66bbfb43b9ad1758a8931b809a62386048c26fd95423f24793d2cb556e0d1c3f24ff6d3ca34f42affc5bbe50ce99af1bcb6eddda247485d15f0a9470
TLSH
T14DA002549720847DD4B413972E0AE271552534C915569D18498C2751FE44B82CAE3561
MD5 SHA1 SHA512 TLSH

Submit Download

null_prank.vbs

Path C:\Users\Admin\AppData\Local\Temp\null_prank.vbs
Size 500B
SHA256 099945a5051db1b894cf5e37dfeb33e010fc48446d20848776cfcdc5dcf2840d
MD5 6eaa60609ef100fc5be7a9a61860a334
SHA1 ed00f7d6607b01d65cee9a54fe7fca99a07358d9
SHA512 9257437858c319f3ded7b224c9ca08b6e3a2bda4bd8bb886b2ada0f06921cdf8065a63abdb6f21531933983bbeb118ce09e2f07dbc00be6a7c288dd2712b6142
TLSH
T1C7F0E52FEEE6D5AA8136E04B12224619E951E93F62039C2A774CCB546F330658C36537
MD5 SHA1 SHA512 TLSH

Submit Download

null_prank.vbs

Path C:\Users\Admin\AppData\Local\Temp\null_prank.vbs
Size 1KB
SHA256 ee6dcb25dff281c6c89b79d2e9f84dc0b0465d79dbddb3b5ae810a365122cf5e
MD5 8eea7eafc52a1dda5b7585b71dd1be71
SHA1 47386a126d7828a37d5543ccaa9cff152bf1a44b
SHA512 9262249e1d6601ff5d307f40da86b3e0f4c4d9b4c2a245dffff9a5425d0c3da762f6afca979e8a9bb06bbb1be5d861b9fa34d5a5e26eb053e5a6f8ad5ebf7460
TLSH
T1DF113D1BDED7C59A8136D04B06324549F992943F61035D3AB79CCB246F73056CEA2133
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads