Analysis
- user interaction
yes - max time kernel
1559s - max time network
1560s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/08/2026, 01:27
General
- Target 1.bat
- Size 1KB
- Sample260804-bt84dsttcs
- SHA256 8ff3699e8d08cea9f58a90464acda09a86ca292c38be586f29d5af9c711cf4a6
Score
3/10
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1.bat"1⤵
- Executes a command shell one-liner
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\LockScreenContentServer.exe"C:\Users\Admin\AppData\Local\Temp\LockScreenContentServer.exe"1⤵
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
0a80293-a908-4c9d-a779-7e58abd689d0
memory/3808-159-0x00000239C20D0000-0x00000239C20FC000-memory.dmp
memory/3808-160-0x00000239DC680000-0x00000239DC68A000-memory.dmp
memory/3808-161-0x00000239DC6B0000-0x00000239DC6B8000-memory.dmp
memory/3808-163-0x00000239DCAB0000-0x00000239DCB58000-memory.dmp
memory/3808-164-0x00000239DC730000-0x00000239DC752000-memory.dmp
memory/3808-165-0x00000239DC710000-0x00000239DC724000-memory.dmp