385f0a7113f2faa0018cecd163cf859f6752055dd46c12f06138059a6da89f0c | Triage™

Login
Reports

Overview

overview

7

Static

static

1

clean.bat

windows10-2004-x64

7

clean.bat

windows11-ltsc_2024-x64

7

Sharing

Copy URL Twitter E-mail

General

Target
clean.bat
Size 11KB
Sample260909-p5d92seq51
SHA256 385f0a7113f2faa0018cecd163cf859f6752055dd46c12f06138059a6da89f0c
MD5 edae7c705f78cb947fce468c9de618bb
SHA1 269ccc96c180c48df8d660b1a3ca731f9a8481af
SHA512 eac51cb7f5c728dbad7193786107646ab9e5585f49090cbe98cfd3ab8c112702ebf4325bbb1ffc5d2581f022bd2bdbaf4ef4049c55a831bdc2e368fe4b177446
SSDEEP 192:yK7f1OYSitcCZUt9mmNUH+SQHtVb9Q2Ze/gjcrxuxoUT7bkjkZcPoaQrwSqtyU6A:ykOYSScCZUt9mmNUeSQNVb9Q2Ze/gjcL
TLSH
T13F32C9573E485E2B419861E5B6EB84022FD9818F01037FD691E395E9A027BF48377BCE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Static task

static1

Behavioral task

behavioral1

Sample

clean.bat

Resource

win10v2004-20260513-en

windows10-2004-x64

9 signatures

150 seconds

defense_evasion discovery execution persistence privilege_escalation

Behavioral task

behavioral2

Sample

clean.bat

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

9 signatures

150 seconds

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Targets

- Target
  clean.bat
- Size 11KB
- SHA256 385f0a7113f2faa0018cecd163cf859f6752055dd46c12f06138059a6da89f0c
- MD5 edae7c705f78cb947fce468c9de618bb
- SHA1 269ccc96c180c48df8d660b1a3ca731f9a8481af
- SHA512 eac51cb7f5c728dbad7193786107646ab9e5585f49090cbe98cfd3ab8c112702ebf4325bbb1ffc5d2581f022bd2bdbaf4ef4049c55a831bdc2e368fe4b177446
- SSDEEP 192:yK7f1OYSitcCZUt9mmNUH+SQHtVb9Q2Ze/gjcrxuxoUT7bkjkZcPoaQrwSqtyU6A:ykOYSScCZUt9mmNUeSQNVb9Q2Ze/gjcL
- TLSH
  T13F32C9573E485E2B419861E5B6EB84022FD9818F01037FD691E395E9A027BF48377BCE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence privilege_escalation
- Stops running service(s)
  defense_evasion execution
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Credential Access

Discovery

Process Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

behavioral2

defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

© 2018-2026

Terms | Privacy