Overview

overview

6

Static

static

1

fe.bat

windows10-ltsc_2021-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    08/08/2026, 15:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fe.bat
  • Size 9KB
  • Sample260808-sd17aas1bt
  • SHA256 7f1d138724d0b532ae4e910e62f82deeeb0d85423585b8f1b959e481d627bed5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasionexecution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fe.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:460
    • C:\Windows\system32\chcp.com
      chcp 65001
      2⤵
        PID:2424
      • C:\Windows\system32\net.exe
        net session
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3744
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 session
          3⤵
            PID:4920
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "$code = { while($true) { Clear-Host; Write-Host '=== RAT & SUSPICIOUS FILES DETECTOR ===' -ForegroundColor Cyan; Write-Host 'Сканирование загрузок, зон риска и сетевых процессов...' -ForegroundColor Yellow; $suspiciousItems = @(); $activeConnections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue; $netProcs = $activeConnections | Select-Object -ExpandProperty OwningProcess -Unique; foreach($pidNum in $netProcs) { $proc = Get-Process -Id $pidNum -ErrorAction SilentlyContinue; if($proc -and $proc.Path) { $pPath = $proc.Path; if($pPath -notlike 'C:\Windows\*' -and $pPath -notlike 'C:\Program Files*') { $statusStr = 'работает (активная сеть)'; $suspiciousItems += [PSCustomObject]@{ Name = $proc.Name; Path = $pPath; Status = $statusStr; IsRunning = $true } } } }; $targetDirs = @(`"$env:USERPROFILE\Downloads`", 'C:\Users\Public', `"$env:TEMP`", `"$env:APPDATA`"); foreach($dir in $targetDirs) { if(Test-Path $dir) { Get-ChildItem -Path $dir -Filter '*.exe' -Recurse -Depth 2 -ErrorAction SilentlyContinue | ForEach-Object { $fPath = $_.FullName; $alreadyAdded = $suspiciousItems | Where-Object { $_.Path -eq $fPath }; if(-not $alreadyAdded) { $runningProc = Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.Path -eq $fPath }; $isRunning = ($runningProc -ne $null); $statusStr = if($isRunning) { 'работает' } else { 'выключен' }; $suspiciousItems += [PSCustomObject]@{ Name = $_.BaseName; Path = $fPath; Status = $statusStr; IsRunning = $isRunning } } } } }; if($suspiciousItems.Count -eq 0) { Write-Host 'Подозрительных файлов в Загрузках и зонах риска не найдено!' -ForegroundColor Green; Read-Host 'Нажмите Enter для выхода'; break }; for($i=0; $i -lt $suspiciousItems.Count; $i++) { $r = $suspiciousItems[$i]; $num = $i + 1; $color = if($r.IsRunning) { 'Red' } else { 'Green' }; Write-Host (' [{0}] - {1} ({2})' -f $num, $r.Name, $r.Status) -ForegroundColor $color; Write-Host (' Путь: ' + $r.Path) -ForegroundColor DarkGray }; Write-Host '----------------------------------------------------'; $sel = Read-Host 'Введите цифру объекта для глубокого анализа в реестре (или Enter для выхода)'; if(-not $sel) { break }; $index = [int]$sel - 1; if($index -ge 0 -and $index -lt $suspiciousItems.Count) { $target = $suspiciousItems[$index]; Clear-Host; Write-Host ('=== АНАЛИЗ УПОМИНАНИЙ В РЕЕСТРЕ ДЛЯ: ' + $target.Name + ' ===') -ForegroundColor Cyan; Write-Host ('Путь: ' + $target.Path) -ForegroundColor Yellow; Write-Host 'Сканирование реестра на наличие следов...' -ForegroundColor Yellow; $regPaths = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run', 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run', 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall', 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'); $matchFound = $false; foreach($rp in $regPaths) { if(Test-Path $rp) { Get-ItemProperty $rp -ErrorAction SilentlyContinue | ForEach-Object { $props = $_.psobject.properties; foreach($prop in $props) { if($prop.Value -like '*' + $target.Name + '*' -or $prop.Name -like '*' + $target.Name + '*') { Write-Host (' [Найдено в реестре] ' + $rp + ' -> ' + $prop.Name + ': ' + $prop.Value) -ForegroundColor Red; $matchFound = $true; } } } } }; if(-not $matchFound) { Write-Host ' В ключевых разделах реестра прямых упоминаний этого имени не обнаружено.' -ForegroundColor Green }; Write-Host ''; Read-Host 'Нажмите Enter, чтобы вернуться к списку' } } }; & $code"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Hide Artifacts: Ignore Process Interrupts
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3908
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -Command "$code = { while($true) { Clear-Host; Write-Host '=== RAT & SUSPICIOUS FILES DETECTOR ===' -ForegroundColor Cyan; Write-Host 'Сканирование загрузок, зон риска и сетевых процессов...' -ForegroundColor Yellow; $suspiciousItems = @(); $activeConnections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue; $netProcs = $activeConnections | Select-Object -ExpandProperty OwningProcess -Unique; foreach($pidNum in $netProcs) { $proc = Get-Process -Id $pidNum -ErrorAction SilentlyContinue; if($proc -and $proc.Path) { $pPath = $proc.Path; if($pPath -notlike 'C:\Windows\*' -and $pPath -notlike 'C:\Program Files*') { $statusStr = 'работает (активная сеть)'; $suspiciousItems += [PSCustomObject]@{ Name = $proc.Name; Path = $pPath; Status = $statusStr; IsRunning = $true } } } }; $targetDirs = @(`"$env:USERPROFILE\Downloads`", 'C:\Users\Public', `"$env:TEMP`", `"$env:APPDATA`"); foreach($dir in $targetDirs) { if(Test-Path $dir) { Get-ChildItem -Path $dir -Filter '*.exe' -Recurse -Depth 2 -ErrorAction SilentlyContinue | ForEach-Object { $fPath = $_.FullName; $alreadyAdded = $suspiciousItems | Where-Object { $_.Path -eq $fPath }; if(-not $alreadyAdded) { $runningProc = Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.Path -eq $fPath }; $isRunning = ($runningProc -ne $null); $statusStr = if($isRunning) { 'работает' } else { 'выключен' }; $suspiciousItems += [PSCustomObject]@{ Name = $_.BaseName; Path = $fPath; Status = $statusStr; IsRunning = $isRunning } } } } }; if($suspiciousItems.Count -eq 0) { Write-Host 'Подозрительных файлов в Загрузках и зонах риска не найдено!' -ForegroundColor Green; Read-Host 'Нажмите Enter для выхода'; break }; for($i=0; $i -lt $suspiciousItems.Count; $i++) { $r = $suspiciousItems[$i]; $num = $i + 1; $color = if($r.IsRunning) { 'Red' } else { 'Green' }; Write-Host (' [{0}] - {1} ({2})' -f $num, $r.Name, $r.Status) -ForegroundColor $color; Write-Host (' Путь: ' + $r.Path) -ForegroundColor DarkGray }; Write-Host '----------------------------------------------------'; $sel = Read-Host 'Введите цифру объекта для глубокого анализа в реестре (или Enter для выхода)'; if(-not $sel) { break }; $index = [int]$sel - 1; if($index -ge 0 -and $index -lt $suspiciousItems.Count) { $target = $suspiciousItems[$index]; Clear-Host; Write-Host ('=== АНАЛИЗ УПОМИНАНИЙ В РЕЕСТРЕ ДЛЯ: ' + $target.Name + ' ===') -ForegroundColor Cyan; Write-Host ('Путь: ' + $target.Path) -ForegroundColor Yellow; Write-Host 'Сканирование реестра на наличие следов...' -ForegroundColor Yellow; $regPaths = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run', 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run', 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies', 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall', 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall'); $matchFound = $false; foreach($rp in $regPaths) { if(Test-Path $rp) { Get-ItemProperty $rp -ErrorAction SilentlyContinue | ForEach-Object { $props = $_.psobject.properties; foreach($prop in $props) { if($prop.Value -like '*' + $target.Name + '*' -or $prop.Name -like '*' + $target.Name + '*') { Write-Host (' [Найдено в реестре] ' + $rp + ' -> ' + $prop.Name + ': ' + $prop.Value) -ForegroundColor Red; $matchFound = $true; } } } } }; if(-not $matchFound) { Write-Host ' В ключевых разделах реестра прямых упоминаний этого имени не обнаружено.' -ForegroundColor Green }; Write-Host ''; Read-Host 'Нажмите Enter, чтобы вернуться к списку' } } }; & $code"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Hide Artifacts: Ignore Process Interrupts
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3484

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 2KB
            • SHA256 df0fcfba7ccb03bac0ccf6941f9cc512937fdc63035a2fedc78aa9a82c1d8af1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 948B
            • SHA256 f4f5bbfef1f236016fa820ebd30a09ac8c69691689a9257c7f70082a08bf0c53
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_aon4surv.aei.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aon4surv.aei.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/3484-16-0x0000021A7B030000-0x0000021A7B040000-memory.dmp
            Download

            memory/3484-17-0x0000021A7B030000-0x0000021A7B040000-memory.dmp
            Download

            memory/3908-0-0x000002709A400000-0x000002709A410000-memory.dmp
            Download

            memory/3908-1-0x000002709A400000-0x000002709A410000-memory.dmp
            Download

            memory/3908-7-0x0000027082190000-0x00000270821B2000-memory.dmp
            Download

            memory/3908-10-0x000002709A400000-0x000002709A410000-memory.dmp
            Download

            memory/3908-11-0x000002709A400000-0x000002709A410000-memory.dmp
            Download

            memory/3908-14-0x000002709C5F0000-0x000002709C80D000-memory.dmp
            Download