Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 17:44
Static task
static1
Behavioral task
behavioral1
Sample
413B.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
413B.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 413B.bat
- Size 242B
- Sample260802-wbky3ayanh
- SHA256 9e6876d559bafc26a95704392dcb81ce50c233eebf9ee2a7834bdfa716384c1a
- MD5 5de1ee1a0d019c6e53ac0b58bf28c6d8
- SHA1 f1be848aef018eeaae21ab75019172f8cfa05707
- SHA512 930dcf4a068717b5d633c79394a303b705c0dfbf0c7360fe7f72e79dd9a560916c43c66c0a03c9cbb975e963895087d1e2990737fce913ed50bb01c75b9dec60
- TLSH T196D0951066EDC0C01F452218535023C1D15207DF400245C313E1389C00C28CDE9E17E4
- MD5 SHA1 SHA512 TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\eventvwr.msc mmc.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4552 cmd.exe - Delays execution with timeout.exe 2 IoCs
pid Process 4624 timeout.exe 4228 timeout.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\mscfile\shell\open\command reg.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\mscfile reg.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\mscfile\shell reg.exe Key created \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\mscfile\shell\open reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\mscfile\shell\open\command\ = "cmd.exe /c start" reg.exe Key deleted \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\mscfile\shell\open\command reg.exe - Modifies registry key 1 TTPs 2 IoCs
pid Process 5044 reg.exe 2756 reg.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1232 mmc.exe - Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeSecurityPrivilege 1232 mmc.exe Token: 33 1232 mmc.exe Token: SeIncBasePriorityPrivilege 1232 mmc.exe Token: 33 1232 mmc.exe Token: SeIncBasePriorityPrivilege 1232 mmc.exe Token: 33 1232 mmc.exe Token: SeIncBasePriorityPrivilege 1232 mmc.exe Token: 33 1232 mmc.exe Token: SeIncBasePriorityPrivilege 1232 mmc.exe Token: 33 1232 mmc.exe Token: SeIncBasePriorityPrivilege 1232 mmc.exe Token: 33 1232 mmc.exe Token: SeIncBasePriorityPrivilege 1232 mmc.exe Token: 33 1232 mmc.exe Token: SeIncBasePriorityPrivilege 1232 mmc.exe Token: 33 1232 mmc.exe Token: SeIncBasePriorityPrivilege 1232 mmc.exe Token: 33 1232 mmc.exe Token: SeIncBasePriorityPrivilege 1232 mmc.exe Token: 33 1232 mmc.exe Token: SeIncBasePriorityPrivilege 1232 mmc.exe Token: 33 1232 mmc.exe Token: SeIncBasePriorityPrivilege 1232 mmc.exe Token: 33 1232 mmc.exe Token: SeIncBasePriorityPrivilege 1232 mmc.exe Token: 33 1232 mmc.exe Token: SeIncBasePriorityPrivilege 1232 mmc.exe Token: 33 1232 mmc.exe Token: SeIncBasePriorityPrivilege 1232 mmc.exe Token: 33 1232 mmc.exe Token: SeIncBasePriorityPrivilege 1232 mmc.exe Token: 33 1232 mmc.exe Token: SeIncBasePriorityPrivilege 1232 mmc.exe Token: SeSecurityPrivilege 1232 mmc.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1232 mmc.exe 1232 mmc.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4552 wrote to memory of 5044 4552 cmd.exe 90 PID 4552 wrote to memory of 4624 4552 cmd.exe 91 PID 4552 wrote to memory of 3884 4552 cmd.exe 92 PID 4552 wrote to memory of 4228 4552 cmd.exe 93 PID 3884 wrote to memory of 1232 3884 eventvwr.exe 94 PID 4552 wrote to memory of 2756 4552 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\413B.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\system32\reg.exeREG ADD HKCU\Software\Classes\mscfile\shell\open\command /ve /d "cmd.exe /c start"2⤵
- Modifies registry class
- Modifies registry key
PID:5044
-
-
C:\Windows\system32\timeout.exetimeout /t 22⤵
- Delays execution with timeout.exe
PID:4624
-
-
C:\Windows\System32\eventvwr.exeC:\Windows\System32\eventvwr.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"3⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1232
-
-
-
C:\Windows\system32\timeout.exetimeout /t 22⤵
- Delays execution with timeout.exe
PID:4228
-
-
C:\Windows\system32\reg.exeREG DELETE HKCU\Software\Classes\mscfile\shell\open\command /f2⤵
- Modifies registry class
- Modifies registry key
PID:2756
-