ff958df6dc1058e27c4f410b8a3d5a1e07133dcdca18fb5cc7812eaa50bdc8a7

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Snapshot/#清理卸载.bat
Size 4KB
Sample260806-m9pkgazanf
SHA256 ff958df6dc1058e27c4f410b8a3d5a1e07133dcdca18fb5cc7812eaa50bdc8a7
MD5 60b672e2d929b40926650e6d9d8a3cdf
SHA1 fa413ec3b1bb6e74dff40b8b70820c1f43bf8d88
SHA512 d2f17e7edcca39a8843a2ebe74622d9ce8bd526c0b3c5692dcdd8082fa779fa2725bf024ea5d5c93c3d934dcdd255b1669b006cd5d328d66de30ccabcb0716de
SSDEEP 96:GCQC8kLYBJYYY/mUYW9V9VJbNMROBrEc/QIMEX1qt4M4G5:3LVMBNCp7/Hr4YO
TLSH
T13EA143162B018A1249E50592DB9ECB5677E7DE0B78307AE923D274D6EE9F35803F02E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4380	attrib.exe

Uses Session Manager for persistence 2 TTPs 1 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	reg.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2144	sc.exe
1676	sc.exe
3672	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4876	cmd.exe
2332	cmd.exe
5060	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5032	timeout.exe

Runs net.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1980	2332	cmd.exe	90
PID 2332 wrote to memory of 4872	2332	cmd.exe	91
PID 2332 wrote to memory of 1176	2332	cmd.exe	92
PID 2332 wrote to memory of 3148	2332	cmd.exe	93
PID 2332 wrote to memory of 5180	2332	cmd.exe	94
PID 2332 wrote to memory of 2144	2332	cmd.exe	95
PID 2332 wrote to memory of 4396	2332	cmd.exe	96
PID 2332 wrote to memory of 5288	2332	cmd.exe	97
PID 2332 wrote to memory of 1720	2332	cmd.exe	98
PID 2332 wrote to memory of 1160	2332	cmd.exe	99
PID 2332 wrote to memory of 4160	2332	cmd.exe	100
PID 2332 wrote to memory of 1120	2332	cmd.exe	101
PID 2332 wrote to memory of 1988	2332	cmd.exe	102
PID 2332 wrote to memory of 4976	2332	cmd.exe	103
PID 2332 wrote to memory of 3108	2332	cmd.exe	104
PID 2332 wrote to memory of 5876	2332	cmd.exe	105
PID 2332 wrote to memory of 5396	2332	cmd.exe	106
PID 2332 wrote to memory of 4468	2332	cmd.exe	107
PID 2332 wrote to memory of 4408	2332	cmd.exe	108
PID 2332 wrote to memory of 4896	2332	cmd.exe	109
PID 2332 wrote to memory of 1028	2332	cmd.exe	110
PID 2332 wrote to memory of 5060	2332	cmd.exe	111
PID 5060 wrote to memory of 3876	5060	cmd.exe	112
PID 2332 wrote to memory of 5516	2332	cmd.exe	113
PID 2332 wrote to memory of 4876	2332	cmd.exe	114
PID 4876 wrote to memory of 5736	4876	cmd.exe	115
PID 2332 wrote to memory of 3744	2332	cmd.exe	116
PID 2332 wrote to memory of 2544	2332	cmd.exe	117
PID 2544 wrote to memory of 3424	2544	net.exe	118
PID 2332 wrote to memory of 1676	2332	cmd.exe	119
PID 2332 wrote to memory of 3672	2332	cmd.exe	120
PID 2332 wrote to memory of 2428	2332	cmd.exe	121
PID 2332 wrote to memory of 4900	2332	cmd.exe	122
PID 2332 wrote to memory of 4380	2332	cmd.exe	123
PID 2332 wrote to memory of 4388	2332	cmd.exe	124
PID 2332 wrote to memory of 5032	2332	cmd.exe	125

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4380	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Snapshot\#清理卸载.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\ControlSet001\Control\MiniNT"
  2⤵
  PID:1980
- C:\Windows\system32\fltMC.exe
  fltMC
  2⤵
  PID:4872
- C:\Windows\system32\find.exe
  find /?
  2⤵
  PID:1176
- C:\Windows\system32\findstr.exe
  findstr /?
  2⤵
  PID:3148
- C:\Windows\system32\reg.exe
  reg /?
  2⤵
  PID:5180
- C:\Windows\system32\sc.exe
  sc query
  2⤵
  - Launches sc.exe
  PID:2144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ver"
  2⤵
  PID:4396
- C:\Windows\system32\findstr.exe
  findstr /i /c:" 5."
  2⤵
  PID:5288
- C:\Windows\system32\mode.com
  Mode 36,6
  2⤵
  PID:1720
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Snapshot" /f
  2⤵
  PID:1160
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.SNA" /f
  2⤵
  PID:4160
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.SNA" /f
  2⤵
  PID:1120
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ExcludedApplications" /f /v "Snapshot.exe"
  2⤵
  PID:1988
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ExcludedApplications" /f /v "Snapshot64.exe"
  2⤵
  PID:4976
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /f /v "C:\Users\Admin\AppData\Local\Temp\Snapshot\Snapshot64.exe.ApplicationCompany"
  2⤵
  PID:3108
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /f /v "C:\Users\Admin\AppData\Local\Temp\Snapshot\Snapshot64.exe.FriendlyAppName"
  2⤵
  PID:5876
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /f /v "C:\Users\Admin\AppData\Local\Temp\Snapshot\Snapshot▒╕╖▌╗╣╘¡.exe.FriendlyAppName"
  2⤵
  PID:5396
- C:\Windows\system32\reg.exe
  reg delete "HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /f /v "C:\Users\Admin\AppData\Local\Temp\Snapshot\Snapshot ▒╕╖▌╗╣╘¡.exe.FriendlyAppName"
  2⤵
  PID:4468
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ExcludedApplications\sukey" /f
  2⤵
  PID:4408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ver"
  2⤵
  PID:4896
- C:\Windows\system32\findstr.exe
  findstr /i /c:" 5."
  2⤵
  PID:1028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ExcludedApplications" /s 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ExcludedApplications" /s
    3⤵
    PID:3876
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ExcludedApplications" /f
  2⤵
  PID:5516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v "BootExecute" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v "BootExecute"
    3⤵
    PID:5736
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /f /v "BootExecute" /t REG_MULTI_SZ /d "autocheck autochk *"
  2⤵
  - Uses Session Manager for persistence
  PID:3744
- C:\Windows\system32\net.exe
  net stop "SNAPSHOD0"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SNAPSHOD0"
    3⤵
    PID:3424
- C:\Windows\system32\sc.exe
  sc stop "SNAPSHOD0"
  2⤵
  - Launches sc.exe
  PID:1676
- C:\Windows\system32\sc.exe
  sc delete "SNAPSHOD0"
  2⤵
  - Launches sc.exe
  PID:3672
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SNAPSHOD0" /f
  2⤵
  PID:2428
- C:\Windows\system32\reg.exe
  reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Snapshot" /f
  2⤵
  PID:4900
- C:\Windows\system32\attrib.exe
  attrib +s +h "C:\Users\Admin\AppData\Local\Temp\EchoX"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4380
- C:\Windows\system32\findstr.exe
  findstr /a:2e .* "╟σ└φ═Ω│╔úíúí*"
  2⤵
  PID:4388
- C:\Windows\system32\timeout.exe
  timeout /t 2
  2⤵
  - Delays execution with timeout.exe
  PID:5032