Resubmissions
12/08/2026, 18:51
260812-xhpq9sec96812/08/2026, 18:48
260812-xf5dya1tbx312/08/2026, 18:43
260812-xc25eaec69312/08/2026, 18:40
260812-xbc4wscq9z312/08/2026, 18:38
260812-w913yasfrg4Analysis
- user interaction
yes - max time kernel
299s - max time network
301s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/08/2026, 18:43
Static task
static1
Behavioral task
behavioral1
Sample
asd/dec.py
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
300 seconds
Behavioral task
behavioral2
Sample
asd/dec.py
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral3
Sample
asd/start.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
300 seconds
Behavioral task
behavioral4
Sample
asd/start.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
General
- Target asd/start.bat
- Size 13B
- Sample260812-xc25eaec69
- SHA256 f9e59b706577f106a4141a9c0e072afcdc6d813fcb1a731a4bdff7deffd3ea9d
- MD5 154ccfde1184a1b2df0f9541574003a7
- SHA1 4b44bb4aad39188a7fc2c77fa010374c879973e6
- SHA512 3eea6fa655650486d0c52596d7f9f0a74fd2a01d66c69204ffbb5308d44be9730c54f800633dc4add8264af900e927bfca5b00f495efc23f7c3738657094a5cd
- MD5 SHA1 SHA512
Score
3/10
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3760 cmd.exe 4524 cmd.exe 2320 cmd.exe 2440 cmd.exe 2684 cmd.exe 2088 cmd.exe 2412 cmd.exe 4008 cmd.exe 1612 cmd.exe 3624 cmd.exe 3680 cmd.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings OpenWith.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2508 NOTEPAD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4416 taskmgr.exe 4500 OpenWith.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4416 taskmgr.exe Token: SeSystemProfilePrivilege 4416 taskmgr.exe Token: SeCreateGlobalPrivilege 4416 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 2508 NOTEPAD.EXE 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe 4416 taskmgr.exe - Suspicious use of SetWindowsHookEx 26 IoCs
pid Process 372 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe 4500 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\asd\start.bat"1⤵
- Executes a command shell one-liner
PID:2320
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4516
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:372
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\asd\start.bat" "1⤵
- Executes a command shell one-liner
PID:2412
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\asd\start.bat" "1⤵
- Executes a command shell one-liner
PID:2440
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4416
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\asd\start.bat" "1⤵
- Executes a command shell one-liner
PID:4008
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\asd\start.bat" "1⤵
- Executes a command shell one-liner
PID:2684
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\asd\start.bat" "1⤵
- Executes a command shell one-liner
PID:1612
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\asd\start.bat" "1⤵
- Executes a command shell one-liner
PID:2088
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\asd\start.bat" "1⤵
- Executes a command shell one-liner
PID:3624
-
C:\Windows\System32\NOTEPAD.EXE"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\asd\start.bat1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:2508
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\asd\start.bat" "1⤵
- Executes a command shell one-liner
PID:3680
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\asd\start.bat" "1⤵
- Executes a command shell one-liner
PID:3760
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\asd\start.bat" "1⤵
- Executes a command shell one-liner
PID:4524
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4500
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵PID:3876
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\asd\start.bat
- Size 31B
- SHA256 e946852f498af242bd93848a48aca4e5fd960dae3b75e8c887cdc6e1d2466ad0
- MD5 1983e0a43bba3e374759fd453b80f8fa
- SHA1 8629cb59d6f7bb18d10ddf884199428210e10e67
- SHA512 ca93e09ba023dae49b52173fa7520bfe6cf7f5e284e89ebe81bcb0d8d0eeb5b0a4288153bdd490517055b93a5339616cd6d91245c7f2d941fd95bf137caeac2c
- MD5 SHA1 SHA512