f6cec063102760b67df60c1d19799348560425841af06a46b9d1084fa2f0591e

Analysis

user interaction
yes
max time kernel
598s
max time network
548s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 20:21

Target
remove_FortiEDRBaseDriver_6.1.1.1292_script.bat
Size 603B
Sample260910-y5bzcsgl91
SHA256 f6cec063102760b67df60c1d19799348560425841af06a46b9d1084fa2f0591e
MD5 4439688d81939c83c6eaf0cef04c2db2
SHA1 11e4487e470a4407f162d5f5fa939092661fdbc5
SHA512 cb2d90c71caea905ee5e9897fdff81dfc29a18aa3db7ea4258b5224fe38a220bc282ec626c29224b5f40ba192f1777e5e505d36ab821c1fbd4f3bc53e153aeaa
TLSH
T1BFF04C3C094B51925A9AAD1DFD0691C737AB534F34904E45B8FC2386FFA4100CBF1863
MD5 SHA1 SHA512 TLSH

Score

7^/10

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4640	sc.exe
1416	sc.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
4588	cmd.exe
4636	cmd.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4636	4588	cmd.exe	88
PID 4636 wrote to memory of 4640	4636	cmd.exe	89
PID 4636 wrote to memory of 3492	4636	cmd.exe	90
PID 4588 wrote to memory of 1416	4588	cmd.exe	91
PID 4588 wrote to memory of 3568	4588	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\remove_FortiEDRBaseDriver_6.1.1.1292_script.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\sc.exe query "" | C:\Windows\System32\findstr.exe STATE
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\System32\sc.exe
    C:\Windows\System32\sc.exe query ""
    3⤵
    - Launches sc.exe
    PID:4640
- - C:\Windows\System32\findstr.exe
    C:\Windows\System32\findstr.exe STATE
    3⤵
    PID:3492
- C:\Windows\System32\sc.exe
  C:\Windows\System32\sc.exe delete
  2⤵
  - Launches sc.exe
  PID:1416
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /delete /tn /f
  2⤵
  PID:3568