Analysis
- max time kernel
148s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/09/2026, 09:57
Static task
static1
Behavioral task
behavioral1
Sample
triage_spill_the_beans.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
triage_spill_the_beans.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target triage_spill_the_beans.bat
- Size 186B
- Sample260907-lzfddatfph
- SHA256 e114467edc1d76a3cf44bb4f4d4f9bd5b7568fec975872efe1b2d7aa9653088e
- MD5 aef7e502b78a1a4e384b9615278885e5
- SHA1 fe96c5f18dade22cfe9df269ea3a2d3e6179380b
- SHA512 49490a66d225cff314fb736458a58796a18b2538e0ec153ce80ecdb56e02bdb986914ef89600bb83bf102e6f961222e23f70746436b995d3ca78bdd670aedfad
- TLSH T12BC02227E02C4862824040A18242B4E2FB390C0315CA1886847F13A26CE05C4BF8AD12
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4196 cmd.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 472 WMIC.exe 472 WMIC.exe 472 WMIC.exe 472 WMIC.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 472 WMIC.exe Token: SeSecurityPrivilege 472 WMIC.exe Token: SeTakeOwnershipPrivilege 472 WMIC.exe Token: SeLoadDriverPrivilege 472 WMIC.exe Token: SeSystemProfilePrivilege 472 WMIC.exe Token: SeSystemtimePrivilege 472 WMIC.exe Token: SeProfSingleProcessPrivilege 472 WMIC.exe Token: SeIncBasePriorityPrivilege 472 WMIC.exe Token: SeCreatePagefilePrivilege 472 WMIC.exe Token: SeBackupPrivilege 472 WMIC.exe Token: SeRestorePrivilege 472 WMIC.exe Token: SeShutdownPrivilege 472 WMIC.exe Token: SeDebugPrivilege 472 WMIC.exe Token: SeSystemEnvironmentPrivilege 472 WMIC.exe Token: SeRemoteShutdownPrivilege 472 WMIC.exe Token: SeUndockPrivilege 472 WMIC.exe Token: SeManageVolumePrivilege 472 WMIC.exe Token: 33 472 WMIC.exe Token: 34 472 WMIC.exe Token: 35 472 WMIC.exe Token: 36 472 WMIC.exe Token: SeIncreaseQuotaPrivilege 472 WMIC.exe Token: SeSecurityPrivilege 472 WMIC.exe Token: SeTakeOwnershipPrivilege 472 WMIC.exe Token: SeLoadDriverPrivilege 472 WMIC.exe Token: SeSystemProfilePrivilege 472 WMIC.exe Token: SeSystemtimePrivilege 472 WMIC.exe Token: SeProfSingleProcessPrivilege 472 WMIC.exe Token: SeIncBasePriorityPrivilege 472 WMIC.exe Token: SeCreatePagefilePrivilege 472 WMIC.exe Token: SeBackupPrivilege 472 WMIC.exe Token: SeRestorePrivilege 472 WMIC.exe Token: SeShutdownPrivilege 472 WMIC.exe Token: SeDebugPrivilege 472 WMIC.exe Token: SeSystemEnvironmentPrivilege 472 WMIC.exe Token: SeRemoteShutdownPrivilege 472 WMIC.exe Token: SeUndockPrivilege 472 WMIC.exe Token: SeManageVolumePrivilege 472 WMIC.exe Token: 33 472 WMIC.exe Token: 34 472 WMIC.exe Token: 35 472 WMIC.exe Token: 36 472 WMIC.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4196 wrote to memory of 472 4196 cmd.exe 90
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\triage_spill_the_beans.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get manufacturer, product2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:472
-