d24b8dd5e00bf5fe4e40334ea442aa855fb0b25e5b185cf6747f8f32f20ab4e3

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/08/2026, 22:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Working.bat
Size 473B
Sample260808-19pr5aff42
SHA256 d24b8dd5e00bf5fe4e40334ea442aa855fb0b25e5b185cf6747f8f32f20ab4e3
MD5 8db637f5bf6a3bbe165fe27d5fcb29f8
SHA1 4c9d58db062f63ffdc747d8751f01264780b30a1
SHA512 ff980edbf5846f01aca038b058563ab43a2e919becee40e957d413f8b59f8732adc4cbd3f3b6eb355c2d4eac2acbb87ce9ea7036f3c93bc50c1bf7b534ac6e2d
TLSH
T1EAF0D41223AE102FC703CA51416C9763379F11C3605D25B51048A93778470DC9FEBEC8
MD5 SHA1 SHA512 TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 21 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6012	cmd.exe
1952	cmd.exe
2724	cmd.exe
3160	cmd.exe
2676	cmd.exe
5768	cmd.exe
4076	cmd.exe
2200	cmd.exe
4640	cmd.exe
5376	cmd.exe
3376	cmd.exe
3480	cmd.exe
4364	cmd.exe
1244	cmd.exe
5152	cmd.exe
5940	cmd.exe
1384	cmd.exe
3544	cmd.exe
5140	cmd.exe
4940	cmd.exe
992	cmd.exe

Delays execution with timeout.exe 21 IoCs

defense_evasion

pid	Process
788	timeout.exe
4536	timeout.exe
3256	timeout.exe
3264	timeout.exe
5948	timeout.exe
3316	timeout.exe
4340	timeout.exe
4372	timeout.exe
5352	timeout.exe
2184	timeout.exe
2996	timeout.exe
3404	timeout.exe
3240	timeout.exe
956	timeout.exe
5344	timeout.exe
5164	timeout.exe
5960	timeout.exe
3384	timeout.exe
4788	timeout.exe
5608	timeout.exe
1224	timeout.exe

Runs net.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5152 wrote to memory of 4976	5152	cmd.exe	80
PID 4976 wrote to memory of 6024	4976	net.exe	81
PID 5152 wrote to memory of 3264	5152	cmd.exe	82
PID 5152 wrote to memory of 4940	5152	cmd.exe	83
PID 4940 wrote to memory of 5020	4940	cmd.exe	84
PID 5020 wrote to memory of 5060	5020	net.exe	85
PID 4940 wrote to memory of 5948	4940	cmd.exe	86
PID 4940 wrote to memory of 3480	4940	cmd.exe	87
PID 3480 wrote to memory of 3816	3480	cmd.exe	88
PID 3816 wrote to memory of 5088	3816	net.exe	89
PID 3480 wrote to memory of 3404	3480	cmd.exe	90
PID 3480 wrote to memory of 3160	3480	cmd.exe	91
PID 3160 wrote to memory of 6092	3160	cmd.exe	92
PID 6092 wrote to memory of 760	6092	net.exe	93
PID 3160 wrote to memory of 3316	3160	cmd.exe	94
PID 3160 wrote to memory of 2676	3160	cmd.exe	95
PID 2676 wrote to memory of 4188	2676	cmd.exe	96
PID 4188 wrote to memory of 3820	4188	net.exe	97
PID 2676 wrote to memory of 4340	2676	cmd.exe	98
PID 2676 wrote to memory of 5768	2676	cmd.exe	99
PID 5768 wrote to memory of 5968	5768	cmd.exe	100
PID 5968 wrote to memory of 3444	5968	net.exe	101
PID 5768 wrote to memory of 4788	5768	cmd.exe	102
PID 5768 wrote to memory of 4364	5768	cmd.exe	103
PID 4364 wrote to memory of 4580	4364	cmd.exe	104
PID 4580 wrote to memory of 2340	4580	net.exe	105
PID 4364 wrote to memory of 4372	4364	cmd.exe	106
PID 4364 wrote to memory of 4076	4364	cmd.exe	107
PID 4076 wrote to memory of 3936	4076	cmd.exe	108
PID 3936 wrote to memory of 3380	3936	net.exe	109
PID 4076 wrote to memory of 3240	4076	cmd.exe	110
PID 4076 wrote to memory of 2200	4076	cmd.exe	111
PID 2200 wrote to memory of 1500	2200	cmd.exe	112
PID 1500 wrote to memory of 5856	1500	net.exe	113
PID 2200 wrote to memory of 956	2200	cmd.exe	114
PID 2200 wrote to memory of 5940	2200	cmd.exe	115
PID 5940 wrote to memory of 5296	5940	cmd.exe	116
PID 5296 wrote to memory of 4060	5296	net.exe	117
PID 5940 wrote to memory of 5352	5940	cmd.exe	118
PID 5940 wrote to memory of 4640	5940	cmd.exe	119
PID 4640 wrote to memory of 1456	4640	cmd.exe	120
PID 1456 wrote to memory of 4068	1456	net.exe	121
PID 4640 wrote to memory of 2184	4640	cmd.exe	122
PID 4640 wrote to memory of 992	4640	cmd.exe	123
PID 992 wrote to memory of 2540	992	cmd.exe	124
PID 2540 wrote to memory of 1012	2540	net.exe	125
PID 992 wrote to memory of 2996	992	cmd.exe	126
PID 992 wrote to memory of 1384	992	cmd.exe	127
PID 1384 wrote to memory of 5136	1384	cmd.exe	128
PID 5136 wrote to memory of 3748	5136	net.exe	129
PID 1384 wrote to memory of 5608	1384	cmd.exe	130
PID 1384 wrote to memory of 6012	1384	cmd.exe	131
PID 6012 wrote to memory of 2740	6012	cmd.exe	132
PID 2740 wrote to memory of 1256	2740	net.exe	133
PID 6012 wrote to memory of 5344	6012	cmd.exe	134
PID 6012 wrote to memory of 3544	6012	cmd.exe	135
PID 3544 wrote to memory of 2988	3544	cmd.exe	136
PID 2988 wrote to memory of 2632	2988	net.exe	137
PID 3544 wrote to memory of 788	3544	cmd.exe	138
PID 3544 wrote to memory of 1952	3544	cmd.exe	139
PID 1952 wrote to memory of 3896	1952	cmd.exe	140
PID 3896 wrote to memory of 1652	3896	net.exe	141
PID 1952 wrote to memory of 1224	1952	cmd.exe	142
PID 1952 wrote to memory of 5376	1952	cmd.exe	143

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Working.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5152
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:6024
- C:\Windows\system32\timeout.exe
  timeout /t 5 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5060
- - C:\Windows\system32\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3816
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:5088
  - - C:\Windows\system32\timeout.exe
      timeout /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3160
    - - C:\Windows\system32\net.exe
        
        net session
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:6092
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:760
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3316
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2676
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:3820
      - C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:4340
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5768
        
        C:\Windows\system32\net.exe
        
        net session
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5968
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        8⤵
        
        PID:3444
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:4788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Windows\system32\net.exe
        
        net session
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        9⤵
        
        PID:2340
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        8⤵
        Delays execution with timeout.exe
        
        PID:4372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
        8⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4076
        
        C:\Windows\system32\net.exe
        
        net session
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        10⤵
        
        PID:3380
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        9⤵
        Delays execution with timeout.exe
        
        PID:3240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
        9⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2200
        
        C:\Windows\system32\net.exe
        
        net session
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1500
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        11⤵
        
        PID:5856
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        10⤵
        Delays execution with timeout.exe
        
        PID:956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
        10⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5940
        
        C:\Windows\system32\net.exe
        
        net session
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:5296
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        12⤵
        
        PID:4060
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        11⤵
        Delays execution with timeout.exe
        
        PID:5352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
        11⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Windows\system32\net.exe
        
        net session
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        13⤵
        
        PID:4068
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        12⤵
        Delays execution with timeout.exe
        
        PID:2184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
        12⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:992
        
        C:\Windows\system32\net.exe
        
        net session
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        14⤵
        
        PID:1012
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        13⤵
        Delays execution with timeout.exe
        
        PID:2996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
        13⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1384
        
        C:\Windows\system32\net.exe
        
        net session
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:5136
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        15⤵
        
        PID:3748
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        14⤵
        Delays execution with timeout.exe
        
        PID:5608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
        14⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6012
        
        C:\Windows\system32\net.exe
        
        net session
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:2740
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        16⤵
        
        PID:1256
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        15⤵
        Delays execution with timeout.exe
        
        PID:5344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
        15⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\system32\net.exe
        
        net session
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        17⤵
        
        PID:2632
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        16⤵
        Delays execution with timeout.exe
        
        PID:788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
        16⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Windows\system32\net.exe
        
        net session
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:3896
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        18⤵
        
        PID:1652
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        17⤵
        Delays execution with timeout.exe
        
        PID:1224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
        17⤵
        Executes a command shell one-liner
        
        PID:5376
        
        C:\Windows\system32\net.exe
        
        net session
        18⤵
        
        PID:2092
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        19⤵
        
        PID:1280
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        18⤵
        Delays execution with timeout.exe
        
        PID:5164
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
        18⤵
        Executes a command shell one-liner
        
        PID:2724
        
        C:\Windows\system32\net.exe
        
        net session
        19⤵
        
        PID:5384
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        20⤵
        
        PID:3524
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        19⤵
        Delays execution with timeout.exe
        
        PID:5960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
        19⤵
        Executes a command shell one-liner
        
        PID:5140
        
        C:\Windows\system32\net.exe
        
        net session
        20⤵
        
        PID:4144
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        21⤵
        
        PID:5712
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        20⤵
        Delays execution with timeout.exe
        
        PID:3384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
        20⤵
        Executes a command shell one-liner
        
        PID:1244
        
        C:\Windows\system32\net.exe
        
        net session
        21⤵
        
        PID:2076
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        22⤵
        
        PID:2816
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        21⤵
        Delays execution with timeout.exe
        
        PID:4536
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Working.bat"
        21⤵
        Executes a command shell one-liner
        
        PID:3376
        
        C:\Windows\system32\net.exe
        
        net session
        22⤵
        
        PID:336
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        23⤵
        
        PID:244
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 5 /nobreak
        22⤵
        Delays execution with timeout.exe
        
        PID:3256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads