f6cec063102760b67df60c1d19799348560425841af06a46b9d1084fa2f0591e

Analysis

max time kernel
598s
max time network
435s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
10/09/2026, 20:21

Target
remove_FortiEDRBaseDriver_6.1.1.1292_script.bat
Size 603B
Sample260910-y5bzcsgl91
SHA256 f6cec063102760b67df60c1d19799348560425841af06a46b9d1084fa2f0591e
MD5 4439688d81939c83c6eaf0cef04c2db2
SHA1 11e4487e470a4407f162d5f5fa939092661fdbc5
SHA512 cb2d90c71caea905ee5e9897fdff81dfc29a18aa3db7ea4258b5224fe38a220bc282ec626c29224b5f40ba192f1777e5e505d36ab821c1fbd4f3bc53e153aeaa
TLSH
T1BFF04C3C094B51925A9AAD1DFD0691C737AB534F34904E45B8FC2386FFA4100CBF1863
MD5 SHA1 SHA512 TLSH

Score

7^/10

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1304	sc.exe
3288	sc.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
4420	cmd.exe
1312	cmd.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 1312	4420	cmd.exe	83
PID 1312 wrote to memory of 1304	1312	cmd.exe	84
PID 1312 wrote to memory of 4840	1312	cmd.exe	85
PID 4420 wrote to memory of 3288	4420	cmd.exe	86
PID 4420 wrote to memory of 3960	4420	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\remove_FortiEDRBaseDriver_6.1.1.1292_script.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\sc.exe query "" | C:\Windows\System32\findstr.exe STATE
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\System32\sc.exe
    C:\Windows\System32\sc.exe query ""
    3⤵
    - Launches sc.exe
    PID:1304
- - C:\Windows\System32\findstr.exe
    C:\Windows\System32\findstr.exe STATE
    3⤵
    PID:4840
- C:\Windows\System32\sc.exe
  C:\Windows\System32\sc.exe delete
  2⤵
  - Launches sc.exe
  PID:3288
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /delete /tn /f
  2⤵
  PID:3960