ff958df6dc1058e27c4f410b8a3d5a1e07133dcdca18fb5cc7812eaa50bdc8a7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Snapshot/#清理卸载.bat
Size 4KB
Sample260806-m9pkgazanf
SHA256 ff958df6dc1058e27c4f410b8a3d5a1e07133dcdca18fb5cc7812eaa50bdc8a7
MD5 60b672e2d929b40926650e6d9d8a3cdf
SHA1 fa413ec3b1bb6e74dff40b8b70820c1f43bf8d88
SHA512 d2f17e7edcca39a8843a2ebe74622d9ce8bd526c0b3c5692dcdd8082fa779fa2725bf024ea5d5c93c3d934dcdd255b1669b006cd5d328d66de30ccabcb0716de
SSDEEP 96:GCQC8kLYBJYYY/mUYW9V9VJbNMROBrEc/QIMEX1qt4M4G5:3LVMBNCp7/Hr4YO
TLSH
T13EA143162B018A1249E50592DB9ECB5677E7DE0B78307AE923D274D6EE9F35803F02E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3392	attrib.exe

Uses Session Manager for persistence 2 TTPs 1 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	reg.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2404	sc.exe
4732	sc.exe
5048	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3352	cmd.exe
4284	cmd.exe
452	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4952	timeout.exe

Runs net.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 4080	4284	cmd.exe	87
PID 4284 wrote to memory of 1144	4284	cmd.exe	88
PID 4284 wrote to memory of 4796	4284	cmd.exe	89
PID 4284 wrote to memory of 3796	4284	cmd.exe	90
PID 4284 wrote to memory of 724	4284	cmd.exe	91
PID 4284 wrote to memory of 5048	4284	cmd.exe	92
PID 4284 wrote to memory of 4932	4284	cmd.exe	93
PID 4284 wrote to memory of 4116	4284	cmd.exe	94
PID 4284 wrote to memory of 5000	4284	cmd.exe	95
PID 4284 wrote to memory of 2056	4284	cmd.exe	96
PID 4284 wrote to memory of 636	4284	cmd.exe	97
PID 4284 wrote to memory of 4728	4284	cmd.exe	98
PID 4284 wrote to memory of 1676	4284	cmd.exe	99
PID 4284 wrote to memory of 3040	4284	cmd.exe	100
PID 4284 wrote to memory of 620	4284	cmd.exe	101
PID 4284 wrote to memory of 3700	4284	cmd.exe	102
PID 4284 wrote to memory of 3704	4284	cmd.exe	103
PID 4284 wrote to memory of 1192	4284	cmd.exe	104
PID 4284 wrote to memory of 3320	4284	cmd.exe	105
PID 4284 wrote to memory of 4792	4284	cmd.exe	106
PID 4284 wrote to memory of 3388	4284	cmd.exe	107
PID 4284 wrote to memory of 452	4284	cmd.exe	108
PID 452 wrote to memory of 4344	452	cmd.exe	109
PID 4284 wrote to memory of 2184	4284	cmd.exe	110
PID 4284 wrote to memory of 3352	4284	cmd.exe	111
PID 3352 wrote to memory of 3336	3352	cmd.exe	112
PID 4284 wrote to memory of 1568	4284	cmd.exe	113
PID 4284 wrote to memory of 1908	4284	cmd.exe	114
PID 1908 wrote to memory of 1652	1908	net.exe	115
PID 4284 wrote to memory of 2404	4284	cmd.exe	116
PID 4284 wrote to memory of 4732	4284	cmd.exe	117
PID 4284 wrote to memory of 2968	4284	cmd.exe	118
PID 4284 wrote to memory of 1632	4284	cmd.exe	119
PID 4284 wrote to memory of 3392	4284	cmd.exe	120
PID 4284 wrote to memory of 3272	4284	cmd.exe	121
PID 4284 wrote to memory of 4952	4284	cmd.exe	122

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3392	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Snapshot\#清理卸载.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\ControlSet001\Control\MiniNT"
  2⤵
  PID:4080
- C:\Windows\system32\fltMC.exe
  fltMC
  2⤵
  PID:1144
- C:\Windows\system32\find.exe
  find /?
  2⤵
  PID:4796
- C:\Windows\system32\findstr.exe
  findstr /?
  2⤵
  PID:3796
- C:\Windows\system32\reg.exe
  reg /?
  2⤵
  PID:724
- C:\Windows\system32\sc.exe
  sc query
  2⤵
  - Launches sc.exe
  PID:5048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ver"
  2⤵
  PID:4932
- C:\Windows\system32\findstr.exe
  findstr /i /c:" 5."
  2⤵
  PID:4116
- C:\Windows\system32\mode.com
  Mode 36,6
  2⤵
  PID:5000
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Snapshot" /f
  2⤵
  PID:2056
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.SNA" /f
  2⤵
  PID:636
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.SNA" /f
  2⤵
  PID:4728
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ExcludedApplications" /f /v "Snapshot.exe"
  2⤵
  PID:1676
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ExcludedApplications" /f /v "Snapshot64.exe"
  2⤵
  PID:3040
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /f /v "C:\Users\Admin\AppData\Local\Temp\Snapshot\Snapshot64.exe.ApplicationCompany"
  2⤵
  PID:620
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /f /v "C:\Users\Admin\AppData\Local\Temp\Snapshot\Snapshot64.exe.FriendlyAppName"
  2⤵
  PID:3700
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /f /v "C:\Users\Admin\AppData\Local\Temp\Snapshot\Snapshot▒╕╖▌╗╣╘¡.exe.FriendlyAppName"
  2⤵
  PID:3704
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /f /v "C:\Users\Admin\AppData\Local\Temp\Snapshot\Snapshot ▒╕╖▌╗╣╘¡.exe.FriendlyAppName"
  2⤵
  PID:1192
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ExcludedApplications\sukey" /f
  2⤵
  PID:3320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ver"
  2⤵
  PID:4792
- C:\Windows\system32\findstr.exe
  findstr /i /c:" 5."
  2⤵
  PID:3388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ExcludedApplications" /s 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ExcludedApplications" /s
    3⤵
    PID:4344
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ExcludedApplications" /f
  2⤵
  PID:2184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v "BootExecute" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v "BootExecute"
    3⤵
    PID:3336
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /f /v "BootExecute" /t REG_MULTI_SZ /d "autocheck autochk *"
  2⤵
  - Uses Session Manager for persistence
  PID:1568
- C:\Windows\system32\net.exe
  net stop "SNAPSHOD0"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SNAPSHOD0"
    3⤵
    PID:1652
- C:\Windows\system32\sc.exe
  sc stop "SNAPSHOD0"
  2⤵
  - Launches sc.exe
  PID:2404
- C:\Windows\system32\sc.exe
  sc delete "SNAPSHOD0"
  2⤵
  - Launches sc.exe
  PID:4732
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SNAPSHOD0" /f
  2⤵
  PID:2968
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Snapshot" /f
  2⤵
  PID:1632
- C:\Windows\system32\attrib.exe
  attrib +s +h "C:\Users\Admin\AppData\Local\Temp\EchoX"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:3392
- C:\Windows\system32\findstr.exe
  findstr /a:2e .* "╟σ└φ═Ω│╔úíúí*"
  2⤵
  PID:3272
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:4952