Analysis
- user interaction
yes - max time kernel
71s - max time network
65s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
26/08/2026, 01:57
General
- Target Shutdown_in_30_Minutes_Task_Scheduler.bat
- Size 670B
- Sample260826-cdme5a1eqc
- SHA256 ff2bd74d5497a647f09634f16d1df733eeb04a10f990b394114115ed38b95962
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Shutdown_in_30_Minutes_Task_Scheduler.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "(Get-Date).AddMinutes(30).ToString('HH:mm')"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-Date).AddMinutes(30).ToString('HH:mm')"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "(Get-Date).ToString('MM/dd/yyyy')"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "(Get-Date).ToString('MM/dd/yyyy')"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn "ShutdownIn30Minutes" /f2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "ShutdownIn30Minutes" /tr "shutdown.exe /s /f" /sc once /sd "08/26/2026" /st "03:28" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\shutdown.exeshutdown.exe1⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
memory/2092-20-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp
memory/2092-14-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp
memory/2092-27-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp
memory/2092-25-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp
memory/2092-24-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp
memory/2092-23-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp
memory/2092-18-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp
memory/2092-22-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp
memory/2092-12-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp
memory/2092-13-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp
memory/2092-21-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp
memory/2092-19-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp
memory/3380-10-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp
memory/3380-1-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp
memory/3380-0-0x00007FFE33FFF000-0x00007FFE34000000-memory.dmp
memory/3380-2-0x0000022F6ABA0000-0x0000022F6ABC2000-memory.dmp
memory/3380-11-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp
memory/3380-8-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp
memory/3380-7-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp
memory/3380-6-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp
memory/3380-5-0x00007FFE33E70000-0x00007FFE34814000-memory.dmp