48ba868c4756f3e5031cfe441ddfe32a9b3641b057d58dce64afabeda885baee

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Service-Destroyer-Lite-V1.6.bat
Size 24KB
Sample260808-tx163azhpe
SHA256 48ba868c4756f3e5031cfe441ddfe32a9b3641b057d58dce64afabeda885baee
MD5 2997d7c80dcb9ac92561a335836596ee
SHA1 842a2be4cc09542ae5bcd23a4a7a1a4a7e6c6627
SHA512 76304ed4934eea2682d30eb8ca3a88de0d6c1a3af590497bcba1d1b2f71908abca302cf0457eb2cd0f56e93fdeb8ac2268749addd0c016b1eec8ba2dac0fd552
SSDEEP 384:ROWFxeq9DTVlQt2hQy2eYhazYRQw4dOwSbDXd/smipdXaNThE+v3sRrlPJRCwmQg:zTVlQt2hQy2eYhazYCOeLHs97EG
TLSH
T1AFB211363189AB170B758D00C8B7DEA8E70143C6CAF625AAF2EE71C82F7160BDD53594
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion execution lateral_movement

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 5 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	reg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	reg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\NextInstance	reg.exe

Remote Services: SMB/Windows Admin Shares 1 TTPs 1 IoCs

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

lateral_movement

SMB/Windows Admin Shares

T1021.002

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LanmanServer\Parameters\NullSessionPipes	reg.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6856	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2556	timeout.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 6856 wrote to memory of 6628	6856	cmd.exe	91
PID 6856 wrote to memory of 6196	6856	cmd.exe	92
PID 6856 wrote to memory of 4828	6856	cmd.exe	93
PID 6856 wrote to memory of 2556	6856	cmd.exe	94
PID 6856 wrote to memory of 5756	6856	cmd.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Service-Destroyer-Lite-V1.6.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6856
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:6628
- C:\Windows\system32\reg.exe
  reg export "HKLM\System\CurrentControlSet\Services" "C:\Service Destroyer\Reg Backup\ServicesBackup.reg" /y
  2⤵
  - Maps connected drives based on registry
  - Remote Services: SMB/Windows Admin Shares
  PID:6196
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4828
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:2556
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:5756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Services

T1021

SMB/Windows Admin Shares

T1021.002

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads