3f401d05f45c3bdffe994e672e1c381bb7d61486082ff20694884f7b741211a0

Resubmissions

13/09/2026, 03:04

260913-dkty8a1alf3

13/09/2026, 02:56

260913-dfbxvaeb998

13/09/2026, 02:53

260913-ddjvnsbn2x8

13/09/2026, 02:52

260913-dcppjabm813

Analysis

user interaction
yes
max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
activator.bat
Size 518B
Sample260913-dkty8a1alf
SHA256 3f401d05f45c3bdffe994e672e1c381bb7d61486082ff20694884f7b741211a0
MD5 dd899a7c6c371916e163ad8e4eae3785
SHA1 aabae22cddf62a8eaca22c5dfe2b5b24b5544fca
SHA512 3b906285d96b0a3a26bbe3ee251942f824c72b7634cb5b136a4c4e64107bd57e467cc90d62f8f6d7f897a4493aab6d090935fc973ca857596041d08c6d0f63ec
TLSH
T15AF0C94B950F540317E212E3E6A5D1D3B62401432A09183EF8678112EA03EC073883D8
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5336	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5336 wrote to memory of 2312	5336	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\activator.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5336
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\VB-Audio\VoiceMeeter" /v "code" /t REG_DWORD /d 0x00123456 /f
  2⤵
  PID:2312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads