Analysis
- max time kernel
148s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 01:59
Static task
static1
Behavioral task
behavioral1
Sample
temp (1).bat
Resource
win10v2004-20260513-en
windows10-2004-x64
35 signatures
150 seconds
General
- Target temp (1).bat
- Size 17KB
- Sample260812-cer21aaa38
- SHA256 b24b70689dba447c9eb671d5917c61786b6cfd5de3f005f12caf71b846ab1645
- MD5 a33d004bfcfa942c8dd1d33bbcc5c94d
- SHA1 60fee2738310e3edfdc6f16343b96bbd26a0d77b
- SHA512 f15ffd3e2a7eed1db5714ce7ad299b97e9da2de5c96d1bf8c8cf6b0930e554b736cb832a1c0eb41efa0660ef0c3583c9709c0e6ae1e4b830071b33d525a49fa9
- SSDEEP 384:NBS3rWnuOHTcYpdJzTwhwgniPySr64PYA0NNL52dMEBffQGbggDBiMJuS8hLhuVw:Nq0TuS8hLhuVmiL3Uj
- TLSH T1DA82B537B4149827C57663B0D9AF2501B265D28B8E013FC1B8EFA0A5271B3D5937E9CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4240 cmd.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4608 PING.EXE 1160 PING.EXE 2088 PING.EXE 4508 PING.EXE 4556 PING.EXE 2572 PING.EXE 5976 PING.EXE - Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 3396 WMIC.exe 2644 WMIC.exe - Runs net.exe
- Runs ping.exe 1 TTPs 7 IoCs
pid Process 1160 PING.EXE 2088 PING.EXE 4508 PING.EXE 4556 PING.EXE 2572 PING.EXE 5976 PING.EXE 4608 PING.EXE - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3396 WMIC.exe 3396 WMIC.exe 3396 WMIC.exe 3396 WMIC.exe 2644 WMIC.exe 2644 WMIC.exe 2644 WMIC.exe 2644 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3396 WMIC.exe Token: SeSecurityPrivilege 3396 WMIC.exe Token: SeTakeOwnershipPrivilege 3396 WMIC.exe Token: SeLoadDriverPrivilege 3396 WMIC.exe Token: SeSystemProfilePrivilege 3396 WMIC.exe Token: SeSystemtimePrivilege 3396 WMIC.exe Token: SeProfSingleProcessPrivilege 3396 WMIC.exe Token: SeIncBasePriorityPrivilege 3396 WMIC.exe Token: SeCreatePagefilePrivilege 3396 WMIC.exe Token: SeBackupPrivilege 3396 WMIC.exe Token: SeRestorePrivilege 3396 WMIC.exe Token: SeShutdownPrivilege 3396 WMIC.exe Token: SeDebugPrivilege 3396 WMIC.exe Token: SeSystemEnvironmentPrivilege 3396 WMIC.exe Token: SeRemoteShutdownPrivilege 3396 WMIC.exe Token: SeUndockPrivilege 3396 WMIC.exe Token: SeManageVolumePrivilege 3396 WMIC.exe Token: 33 3396 WMIC.exe Token: 34 3396 WMIC.exe Token: 35 3396 WMIC.exe Token: 36 3396 WMIC.exe Token: SeIncreaseQuotaPrivilege 3396 WMIC.exe Token: SeSecurityPrivilege 3396 WMIC.exe Token: SeTakeOwnershipPrivilege 3396 WMIC.exe Token: SeLoadDriverPrivilege 3396 WMIC.exe Token: SeSystemProfilePrivilege 3396 WMIC.exe Token: SeSystemtimePrivilege 3396 WMIC.exe Token: SeProfSingleProcessPrivilege 3396 WMIC.exe Token: SeIncBasePriorityPrivilege 3396 WMIC.exe Token: SeCreatePagefilePrivilege 3396 WMIC.exe Token: SeBackupPrivilege 3396 WMIC.exe Token: SeRestorePrivilege 3396 WMIC.exe Token: SeShutdownPrivilege 3396 WMIC.exe Token: SeDebugPrivilege 3396 WMIC.exe Token: SeSystemEnvironmentPrivilege 3396 WMIC.exe Token: SeRemoteShutdownPrivilege 3396 WMIC.exe Token: SeUndockPrivilege 3396 WMIC.exe Token: SeManageVolumePrivilege 3396 WMIC.exe Token: 33 3396 WMIC.exe Token: 34 3396 WMIC.exe Token: 35 3396 WMIC.exe Token: 36 3396 WMIC.exe Token: SeIncreaseQuotaPrivilege 2644 WMIC.exe Token: SeSecurityPrivilege 2644 WMIC.exe Token: SeTakeOwnershipPrivilege 2644 WMIC.exe Token: SeLoadDriverPrivilege 2644 WMIC.exe Token: SeSystemProfilePrivilege 2644 WMIC.exe Token: SeSystemtimePrivilege 2644 WMIC.exe Token: SeProfSingleProcessPrivilege 2644 WMIC.exe Token: SeIncBasePriorityPrivilege 2644 WMIC.exe Token: SeCreatePagefilePrivilege 2644 WMIC.exe Token: SeBackupPrivilege 2644 WMIC.exe Token: SeRestorePrivilege 2644 WMIC.exe Token: SeShutdownPrivilege 2644 WMIC.exe Token: SeDebugPrivilege 2644 WMIC.exe Token: SeSystemEnvironmentPrivilege 2644 WMIC.exe Token: SeRemoteShutdownPrivilege 2644 WMIC.exe Token: SeUndockPrivilege 2644 WMIC.exe Token: SeManageVolumePrivilege 2644 WMIC.exe Token: 33 2644 WMIC.exe Token: 34 2644 WMIC.exe Token: 35 2644 WMIC.exe Token: 36 2644 WMIC.exe Token: SeIncreaseQuotaPrivilege 2644 WMIC.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4240 wrote to memory of 3088 4240 cmd.exe 90 PID 4240 wrote to memory of 5448 4240 cmd.exe 91 PID 5448 wrote to memory of 3336 5448 net.exe 92 PID 4240 wrote to memory of 3396 4240 cmd.exe 93 PID 4240 wrote to memory of 5452 4240 cmd.exe 94 PID 4240 wrote to memory of 2644 4240 cmd.exe 96 PID 4240 wrote to memory of 5808 4240 cmd.exe 97 PID 4240 wrote to memory of 5976 4240 cmd.exe 98 PID 4240 wrote to memory of 4608 4240 cmd.exe 99 PID 4240 wrote to memory of 1160 4240 cmd.exe 100 PID 4240 wrote to memory of 2088 4240 cmd.exe 101 PID 4240 wrote to memory of 4508 4240 cmd.exe 102 PID 4240 wrote to memory of 4556 4240 cmd.exe 103 PID 4240 wrote to memory of 2572 4240 cmd.exe 104
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\temp (1).bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\system32\mode.commode con cols=90 lines=352⤵PID:3088
-
-
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:3336
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_videocontroller get name2⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3396
-
-
C:\Windows\system32\find.exefind "NVIDIA"2⤵PID:5452
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_videocontroller get name2⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
-
C:\Windows\system32\find.exefind "AMD"2⤵PID:5808
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 22⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5976
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 22⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4608
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 22⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1160
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2088
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 22⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4508
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4556
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 22⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2572
-