0b30cb8b8aa35b9aa808f70d31170161f0a4992f0903f9600871c15b6d71c672

Resubmissions

09/08/2026, 07:32

260809-jdgm7swzay7

09/08/2026, 07:27

260809-jag5kabm917

09/08/2026, 07:24

260809-h8rafsshrh7

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 07:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cisteni.bat
Size 11KB
Sample260809-h8rafsshrh
SHA256 0b30cb8b8aa35b9aa808f70d31170161f0a4992f0903f9600871c15b6d71c672
MD5 c8f5b685d74d072b1472055616cf70ad
SHA1 eee327a762d67ee4851e97a8b43a71b40ce95df1
SHA512 e53d73f09ee59d0a08e8467c793a8b9b843b4f605957aecda0b317798e964718fe69769e8303090c173f80c3bc140f0b7930ef7959bfed4b6c7913dc144c71d0
SSDEEP 192:w4/4e4nvfOI9nskJZ3zrOUqOvOPO7FK5mR7vT13rNo/VBpMLQB+CCaUbV27c:wqmN9nssFvqg0q4UjQy0c
TLSH
T11642300D3E514866AEB0E248D53E0051E377978B1851BB8874EFF0B5AB3239572BE4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

execution

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6128	cmd.exe

Runs net.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 6128 wrote to memory of 5656	6128	cmd.exe	90
PID 5656 wrote to memory of 5036	5656	net.exe	91
PID 6128 wrote to memory of 1528	6128	cmd.exe	92
PID 6128 wrote to memory of 3068	6128	cmd.exe	93
PID 6128 wrote to memory of 1196	6128	cmd.exe	94
PID 1196 wrote to memory of 5468	1196	Dism.exe	95
PID 6128 wrote to memory of 5752	6128	cmd.exe	96
PID 6128 wrote to memory of 4904	6128	cmd.exe	97
PID 6128 wrote to memory of 3320	6128	cmd.exe	98
PID 6128 wrote to memory of 3760	6128	cmd.exe	99
PID 6128 wrote to memory of 4160	6128	cmd.exe	100
PID 6128 wrote to memory of 3308	6128	cmd.exe	101
PID 6128 wrote to memory of 4460	6128	cmd.exe	102
PID 6128 wrote to memory of 5732	6128	cmd.exe	103
PID 6128 wrote to memory of 1392	6128	cmd.exe	104
PID 6128 wrote to memory of 3944	6128	cmd.exe	105

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Cisteni.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6128
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5656
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:5036
- C:\Windows\system32\choice.exe
  choice /c AN /t 20 /d A /m "Chcete nyni spustit udrzbu a audit systemu?"
  2⤵
  PID:1528
- C:\Windows\system32\choice.exe
  choice /c 12 /t 10 /d 1 /m "Zadejte cislo volby (1 nebo 2, po 10s automaticky 1): "
  2⤵
  PID:3068
- C:\Windows\system32\Dism.exe
  dism /online /cleanup-image /restorehealth
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {5C3AC27B-A970-4338-81D0-1048B4180783}
    3⤵
    - Drops file in Windows directory
    PID:5468
- C:\Windows\system32\sfc.exe
  sfc /scannow
  2⤵
  PID:5752
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools
  2⤵
  PID:4904
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr
  2⤵
  PID:3320
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Policies\Microsoft\Windows\System" /v DisableCMD
  2⤵
  PID:3760
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Classes\exefile\shell\open\command"
  2⤵
  PID:4160
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v FilterAdministratorToken
  2⤵
  PID:3308
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA
  2⤵
  PID:4460
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper
  2⤵
  PID:5732
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v TaskbarSizeMove
  2⤵
  PID:1392
- C:\Windows\system32\reg.exe
  reg query "HKCU\Control Panel\Colors" /v Background
  2⤵
  PID:3944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 285KB
SHA256 ed1d1ce86343bb561f6202e2f89cfe484c776df25d36fd792c3828d7881229ef
MD5 2cb0e7bd81b3187c7d56ddff2b23576f
SHA1 babb6609bdb3d1ebcb81fafcae0c24105088ceee
SHA512 660eb325c00fb3d35fc20a78bfb507df970f11a45400fcb9afe8cfd0243e9648a21f349e0213fa12acb41b4d9b088ee496aa8850a8301a1ae31ec2040ad294ea
SSDEEP 6144:YIRm1F15QfCfdfZ1216E12p7GDmltCY/fJffGdjCpQLp8hAFUfhzAM8bU:YgbU
TLSH
T10C54E02E07AB0931918988037671DBFDA3DBB493B6C8F324766FE13967C26864F1E550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download