Analysis
- user interaction
yes - max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/09/2026, 09:57
Static task
static1
Behavioral task
behavioral1
Sample
triage_spill_the_beans.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
triage_spill_the_beans.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target triage_spill_the_beans.bat
- Size 186B
- Sample260907-lzfddatfph
- SHA256 e114467edc1d76a3cf44bb4f4d4f9bd5b7568fec975872efe1b2d7aa9653088e
- MD5 aef7e502b78a1a4e384b9615278885e5
- SHA1 fe96c5f18dade22cfe9df269ea3a2d3e6179380b
- SHA512 49490a66d225cff314fb736458a58796a18b2538e0ec153ce80ecdb56e02bdb986914ef89600bb83bf102e6f961222e23f70746436b995d3ca78bdd670aedfad
- TLSH T12BC02227E02C4862824040A18242B4E2FB390C0315CA1886847F13A26CE05C4BF8AD12
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1104 cmd.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1276 NOTEPAD.EXE - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3676 WMIC.exe Token: SeSecurityPrivilege 3676 WMIC.exe Token: SeTakeOwnershipPrivilege 3676 WMIC.exe Token: SeLoadDriverPrivilege 3676 WMIC.exe Token: SeSystemProfilePrivilege 3676 WMIC.exe Token: SeSystemtimePrivilege 3676 WMIC.exe Token: SeProfSingleProcessPrivilege 3676 WMIC.exe Token: SeIncBasePriorityPrivilege 3676 WMIC.exe Token: SeCreatePagefilePrivilege 3676 WMIC.exe Token: SeBackupPrivilege 3676 WMIC.exe Token: SeRestorePrivilege 3676 WMIC.exe Token: SeShutdownPrivilege 3676 WMIC.exe Token: SeDebugPrivilege 3676 WMIC.exe Token: SeSystemEnvironmentPrivilege 3676 WMIC.exe Token: SeRemoteShutdownPrivilege 3676 WMIC.exe Token: SeUndockPrivilege 3676 WMIC.exe Token: SeManageVolumePrivilege 3676 WMIC.exe Token: 33 3676 WMIC.exe Token: 34 3676 WMIC.exe Token: 35 3676 WMIC.exe Token: 36 3676 WMIC.exe Token: SeIncreaseQuotaPrivilege 3676 WMIC.exe Token: SeSecurityPrivilege 3676 WMIC.exe Token: SeTakeOwnershipPrivilege 3676 WMIC.exe Token: SeLoadDriverPrivilege 3676 WMIC.exe Token: SeSystemProfilePrivilege 3676 WMIC.exe Token: SeSystemtimePrivilege 3676 WMIC.exe Token: SeProfSingleProcessPrivilege 3676 WMIC.exe Token: SeIncBasePriorityPrivilege 3676 WMIC.exe Token: SeCreatePagefilePrivilege 3676 WMIC.exe Token: SeBackupPrivilege 3676 WMIC.exe Token: SeRestorePrivilege 3676 WMIC.exe Token: SeShutdownPrivilege 3676 WMIC.exe Token: SeDebugPrivilege 3676 WMIC.exe Token: SeSystemEnvironmentPrivilege 3676 WMIC.exe Token: SeRemoteShutdownPrivilege 3676 WMIC.exe Token: SeUndockPrivilege 3676 WMIC.exe Token: SeManageVolumePrivilege 3676 WMIC.exe Token: 33 3676 WMIC.exe Token: 34 3676 WMIC.exe Token: 35 3676 WMIC.exe Token: 36 3676 WMIC.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1104 wrote to memory of 3676 1104 cmd.exe 87
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\triage_spill_the_beans.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get manufacturer, product2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\report.txt1⤵
- Opens file in notepad (likely ransom note)
PID:1276
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Desktop\report.txt
- Size 6B
- SHA256 2e08d1f6000aef541797d008c05ac36f4dbebfb36cbac5615788e6fcc5b300a7
- MD5 bea07e6d2b8dce396fe21baa61b34956
- SHA1 665332b36fc8fa1ed11210cdee83b639b451e592
- SHA512 4ad82fbef6d8d3f4d0b90a9399c8b405674bad0c750e385fb034e57895838fd26d7926f6ed0ccab2e2afcaf4a23613ed8f16d909bff870b40187e22e0a6362c1
- MD5 SHA1 SHA512