f6cec063102760b67df60c1d19799348560425841af06a46b9d1084fa2f0591e

Analysis

max time kernel
598s
max time network
408s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/09/2026, 20:21

Target
remove_FortiEDRBaseDriver_6.1.1.1292_script.bat
Size 603B
Sample260910-y5bzcsgl91
SHA256 f6cec063102760b67df60c1d19799348560425841af06a46b9d1084fa2f0591e
MD5 4439688d81939c83c6eaf0cef04c2db2
SHA1 11e4487e470a4407f162d5f5fa939092661fdbc5
SHA512 cb2d90c71caea905ee5e9897fdff81dfc29a18aa3db7ea4258b5224fe38a220bc282ec626c29224b5f40ba192f1777e5e505d36ab821c1fbd4f3bc53e153aeaa
TLSH
T1BFF04C3C094B51925A9AAD1DFD0691C737AB534F34904E45B8FC2386FFA4100CBF1863
MD5 SHA1 SHA512 TLSH

Score

7^/10

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3284	sc.exe
1144	sc.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
3124	cmd.exe
4204	cmd.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 4204	3124	cmd.exe	81
PID 4204 wrote to memory of 1144	4204	cmd.exe	82
PID 4204 wrote to memory of 3076	4204	cmd.exe	83
PID 3124 wrote to memory of 3284	3124	cmd.exe	84
PID 3124 wrote to memory of 484	3124	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\remove_FortiEDRBaseDriver_6.1.1.1292_script.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\System32\sc.exe query "" | C:\Windows\System32\findstr.exe STATE
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\System32\sc.exe
    C:\Windows\System32\sc.exe query ""
    3⤵
    - Launches sc.exe
    PID:1144
- - C:\Windows\System32\findstr.exe
    C:\Windows\System32\findstr.exe STATE
    3⤵
    PID:3076
- C:\Windows\System32\sc.exe
  C:\Windows\System32\sc.exe delete
  2⤵
  - Launches sc.exe
  PID:3284
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /delete /tn /f
  2⤵
  PID:484