7786c80b09fa327bb670ef4760bf608d585924ce562fbb57800f10ddd92c9f30

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 12:27

Target
$1/MGS/cleanMGSTasks.bat
Size 592B
Sample260802-pm286asgre
SHA256 7786c80b09fa327bb670ef4760bf608d585924ce562fbb57800f10ddd92c9f30
MD5 4c8aa85b300e772fb157f0492d41eefe
SHA1 98ac5683263786a394f5a29dd83236ca80b96b03
SHA512 c3130d59a0b56b88ad17ac2b96c6c506b1ffad1614efaf0b5c5ecca5559d09c5add4b418d13be2572079455f16751f1f2a44b9a9401efcbe085dc456eb7adb14
TLSH
T119F046EE260AE3302BC56F7C32251A951990A2A6BB711291F85D1308D5DC81CC1FF7DA
MD5 SHA1 SHA512 TLSH

Score

3^/10

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
1760	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3876	schtasks.exe
3464	schtasks.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 3876	1760	cmd.exe	85
PID 1760 wrote to memory of 3464	1760	cmd.exe	86
PID 1760 wrote to memory of 4288	1760	cmd.exe	87
PID 1760 wrote to memory of 3264	1760	cmd.exe	88
PID 1760 wrote to memory of 1824	1760	cmd.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\$1\MGS\cleanMGSTasks.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\system32\schtasks.exe
  SCHTASKS /CREATE /SC DAILY /TN "McAfee\MGS\Update" /TR "McAfee" /ST 00:00 /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3876
- C:\Windows\system32\schtasks.exe
  SCHTASKS /CREATE /SC DAILY /TN "McAfee\MGS\Update Maintenance" /TR "McAfee" /ST 00:00 /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3464
- C:\Windows\system32\schtasks.exe
  SCHTASKS /DELETE /TN "McAfee\MGS\Update" /F
  2⤵
  PID:4288
- C:\Windows\system32\schtasks.exe
  SCHTASKS /DELETE /TN "McAfee\MGS\Update Maintenance" /F
  2⤵
  PID:3264
- C:\Windows\system32\schtasks.exe
  SCHTASKS /DELETE /TN "McAfee\MGS" /F
  2⤵
  PID:1824