0b30cb8b8aa35b9aa808f70d31170161f0a4992f0903f9600871c15b6d71c672

Resubmissions

09/08/2026, 07:32

260809-jdgm7swzay7

09/08/2026, 07:27

260809-jag5kabm917

09/08/2026, 07:24

260809-h8rafsshrh7

Analysis

user interaction
yes
max time kernel
82s
max time network
82s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cisteni.bat
Size 11KB
Sample260809-jag5kabm91
SHA256 0b30cb8b8aa35b9aa808f70d31170161f0a4992f0903f9600871c15b6d71c672
MD5 c8f5b685d74d072b1472055616cf70ad
SHA1 eee327a762d67ee4851e97a8b43a71b40ce95df1
SHA512 e53d73f09ee59d0a08e8467c793a8b9b843b4f605957aecda0b317798e964718fe69769e8303090c173f80c3bc140f0b7930ef7959bfed4b6c7913dc144c71d0
SSDEEP 192:w4/4e4nvfOI9nskJZ3zrOUqOvOPO7FK5mR7vT13rNo/VBpMLQB+CCaUbV27c:wqmN9nssFvqg0q4UjQy0c
TLSH
T11642300D3E514866AEB0E248D53E0051E377978B1851BB8874EFF0B5AB3239572BE4DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

execution

Malware Config

Signatures

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4936	cmd.exe

Runs net.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 6036	4936	cmd.exe	90
PID 6036 wrote to memory of 2256	6036	net.exe	91
PID 4936 wrote to memory of 6040	4936	cmd.exe	92
PID 4936 wrote to memory of 1056	4936	cmd.exe	93
PID 4936 wrote to memory of 3864	4936	cmd.exe	95
PID 3864 wrote to memory of 2844	3864	Dism.exe	96
PID 4936 wrote to memory of 4220	4936	cmd.exe	97
PID 4936 wrote to memory of 4236	4936	cmd.exe	98
PID 4936 wrote to memory of 4196	4936	cmd.exe	99
PID 4936 wrote to memory of 4928	4936	cmd.exe	100
PID 4936 wrote to memory of 2404	4936	cmd.exe	101
PID 4936 wrote to memory of 4420	4936	cmd.exe	102
PID 4936 wrote to memory of 2524	4936	cmd.exe	103
PID 4936 wrote to memory of 5560	4936	cmd.exe	104
PID 4936 wrote to memory of 3092	4936	cmd.exe	105
PID 4936 wrote to memory of 6092	4936	cmd.exe	106

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Cisteni.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6036
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2256
- C:\Windows\system32\choice.exe
  choice /c AN /t 20 /d A /m "Chcete nyni spustit udrzbu a audit systemu?"
  2⤵
  PID:6040
- C:\Windows\system32\choice.exe
  choice /c 12 /t 10 /d 1 /m "Zadejte cislo volby (1 nebo 2, po 10s automaticky 1): "
  2⤵
  PID:1056
- C:\Windows\system32\Dism.exe
  dism /online /cleanup-image /restorehealth
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\System32\Dism\dismhost.exe
    C:\Windows\System32\Dism\dismhost.exe {E0AA9FB2-8869-4E42-ADA0-D5B978D558E1}
    3⤵
    - Drops file in Windows directory
    PID:2844
- C:\Windows\system32\sfc.exe
  sfc /scannow
  2⤵
  PID:4220
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools
  2⤵
  PID:4236
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr
  2⤵
  PID:4196
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Policies\Microsoft\Windows\System" /v DisableCMD
  2⤵
  PID:4928
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Classes\exefile\shell\open\command"
  2⤵
  PID:2404
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v FilterAdministratorToken
  2⤵
  PID:4420
- C:\Windows\system32\reg.exe
  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA
  2⤵
  PID:2524
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper
  2⤵
  PID:5560
- C:\Windows\system32\reg.exe
  reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v TaskbarSizeMove
  2⤵
  PID:3092
- C:\Windows\system32\reg.exe
  reg query "HKCU\Control Panel\Colors" /v Background
  2⤵
  PID:6092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 285KB
SHA256 b7e88a3a3441163aea2e9b75c7dc86cbefbaa330aa541f87c80056250b3a24d4
MD5 7e63d505487d1e9634836b1d288e7c0f
SHA1 6cc4344e3600893c2833a3675b946117ca18312a
SHA512 02683664cb80f112bae512cdeb8ca19d61c3b7ae5a9f0533f4d52bba2912242a7ff626dcc68650caa48ac2fd194f961b2ab8f975a7136d9d6fa52ea4b41ed738
SSDEEP 1536:JN25wlYt53pNAfnFRIW41L1bboNnedzn9syJ9pK/bzCVPYnYsLWaxJOUbYafgusg:ywyJznRD6
TLSH
T14654BD1E43AF4DB1A149C40372799AFDA1D6B482A6C8F354772FD22A77C158B8F1F680
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download