cab883b4ae93e77e06f51ea422591a06b945479174884270005ae67353272f43

Analysis

max time kernel
58s
max time network
60s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
31/07/2026, 16:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hwid-changer-games-main/cleaner.bat
Size 5KB
Sample260731-vesbwack71
SHA256 cab883b4ae93e77e06f51ea422591a06b945479174884270005ae67353272f43
MD5 b3c21fa1ccda2feecefb69b327441642
SHA1 1ca39a22c49557f0ac177658efa9674300599c85
SHA512 a7145449b795c2386fb1a9c5e0b320811d557a47b408f444c90eab7ffbcff7216e939f47a3eb26eecfdad4fd00b7be79c3082803822226702fc8215cf70ee0ce
SSDEEP 96:lbVenI8xeMz8mqtVtHf1fYhSfxE8QYbI4Kc:lVenInMhqzxf1fYhSfCYbVKc
TLSH
T1F0C1C043196FC1A42A43D05A61655425D0ACA5EF771D03D2373EAABE02C5CACE8CFE7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1296	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4384	timeout.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
780	taskkill.exe
4004	taskkill.exe
1788	taskkill.exe
4716	taskkill.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	780	taskkill.exe
Token: SeDebugPrivilege	4004	taskkill.exe
Token: SeDebugPrivilege	1788	taskkill.exe
Token: SeDebugPrivilege	4716	taskkill.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 5048	1296	cmd.exe	84
PID 1296 wrote to memory of 780	1296	cmd.exe	85
PID 1296 wrote to memory of 4004	1296	cmd.exe	87
PID 1296 wrote to memory of 3852	1296	cmd.exe	88
PID 1296 wrote to memory of 2296	1296	cmd.exe	89
PID 1296 wrote to memory of 4104	1296	cmd.exe	90
PID 1296 wrote to memory of 3300	1296	cmd.exe	91
PID 1296 wrote to memory of 2740	1296	cmd.exe	92
PID 1296 wrote to memory of 2476	1296	cmd.exe	93
PID 1296 wrote to memory of 1788	1296	cmd.exe	94
PID 1296 wrote to memory of 4716	1296	cmd.exe	95
PID 1296 wrote to memory of 5064	1296	cmd.exe	96
PID 1296 wrote to memory of 4384	1296	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hwid-changer-games-main\cleaner.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:5048
- C:\Windows\system32\taskkill.exe
  taskkill /IM Agent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:780
- C:\Windows\system32\taskkill.exe
  taskkill /IM Battle.net.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4004
- C:\Windows\system32\reg.exe
  reg delete "HKCU\Software\Blizzard Entertainment\Battle.net" /f
  2⤵
  PID:3852
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Blizzard Entertainment" /f
  2⤵
  PID:2296
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Blizzard Entertainment" /f
  2⤵
  PID:4104
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\WOW6432Node\Blizzard Entertainment" /f
  2⤵
  PID:3300
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Blizzard Entertainment\Battle.net\Identity" /f
  2⤵
  PID:2740
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\InstallTime" /f
  2⤵
  PID:2476
- C:\Windows\system32\taskkill.exe
  taskkill /IM Agent.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1788
- C:\Windows\system32\taskkill.exe
  taskkill /IM Battle.net.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4716
- C:\Windows\system32\rundll32.exe
  rundll32 user32.dll,MessageBeep
  2⤵
  PID:5064
- C:\Windows\system32\timeout.exe
  timeout 4
  2⤵
  - Delays execution with timeout.exe
  PID:4384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads