e70299fe38147d8b745848c151175b2407c5f9b8f12f9e05e713a62050bb48b5

Analysis

max time kernel
8s
max time network
5s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 21:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
untitled.bat
Size 1KB
Sample260928-1ssgpavyfs
SHA256 e70299fe38147d8b745848c151175b2407c5f9b8f12f9e05e713a62050bb48b5
MD5 7e494d3e60397974d9b47b087a2d1c21
SHA1 57ddc2154f662841985bbc0ee05f0aab3c0eb817
SHA512 98ee12e37770cc2531c51f83f2c9081058abf709ea1c86fb0e217be9df2d5e5237dec24a8ba1c9122a127bb6c8e386a6574f131eb9f490dc07472d740f001ee1
TLSH
T1222129713136F29102EB2AF00D31A259FE0AE1CB96055DC0F01FE0BE8708FD6356B6A6
MD5 SHA1 SHA512 TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 17 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4312	cmd.exe
3256	cmd.exe
2480	cmd.exe
3204	cmd.exe
6016	cmd.exe
4284	cmd.exe
5392	cmd.exe
2104	cmd.exe
4528	cmd.exe
2344	cmd.exe
1148	cmd.exe
3684	cmd.exe
4844	cmd.exe
3636	cmd.exe
2856	cmd.exe
3056	cmd.exe
4192	cmd.exe

Delays execution with timeout.exe 14 IoCs

defense_evasion

pid	Process
2160	timeout.exe
5512	timeout.exe
2036	timeout.exe
504	timeout.exe
1352	timeout.exe
4164	timeout.exe
3760	timeout.exe
5892	timeout.exe
4972	timeout.exe
1120	timeout.exe
1688	timeout.exe
832	timeout.exe
2384	timeout.exe
2612	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5984	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5984	taskkill.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 3412	1148	cmd.exe	91
PID 1148 wrote to memory of 4972	1148	cmd.exe	92
PID 1148 wrote to memory of 1120	1148	cmd.exe	93
PID 1148 wrote to memory of 5356	1148	cmd.exe	94
PID 1148 wrote to memory of 4312	1148	cmd.exe	95
PID 1148 wrote to memory of 3684	1148	cmd.exe	96
PID 1148 wrote to memory of 4284	1148	cmd.exe	97
PID 1148 wrote to memory of 5392	1148	cmd.exe	98
PID 1148 wrote to memory of 3256	1148	cmd.exe	99
PID 1148 wrote to memory of 2856	1148	cmd.exe	100
PID 1148 wrote to memory of 3204	1148	cmd.exe	101
PID 1148 wrote to memory of 2480	1148	cmd.exe	102
PID 1148 wrote to memory of 3056	1148	cmd.exe	105
PID 1148 wrote to memory of 2104	1148	cmd.exe	106
PID 1148 wrote to memory of 2160	1148	cmd.exe	107
PID 3256 wrote to memory of 5512	3256	cmd.exe	116
PID 3056 wrote to memory of 2036	3056	cmd.exe	117
PID 2856 wrote to memory of 504	2856	cmd.exe	118
PID 5392 wrote to memory of 1688	5392	cmd.exe	119
PID 3204 wrote to memory of 1352	3204	cmd.exe	120
PID 4284 wrote to memory of 4164	4284	cmd.exe	121
PID 4312 wrote to memory of 832	4312	cmd.exe	122
PID 2104 wrote to memory of 3760	2104	cmd.exe	123
PID 2480 wrote to memory of 5892	2480	cmd.exe	124
PID 3684 wrote to memory of 2384	3684	cmd.exe	125
PID 1148 wrote to memory of 4528	1148	cmd.exe	126
PID 4528 wrote to memory of 4812	4528	cmd.exe	127
PID 1148 wrote to memory of 6016	1148	cmd.exe	128
PID 6016 wrote to memory of 2252	6016	cmd.exe	129
PID 1148 wrote to memory of 2344	1148	cmd.exe	130
PID 2344 wrote to memory of 5952	2344	cmd.exe	131
PID 1148 wrote to memory of 4192	1148	cmd.exe	132
PID 4192 wrote to memory of 4412	4192	cmd.exe	133
PID 1148 wrote to memory of 4844	1148	cmd.exe	134
PID 4844 wrote to memory of 4088	4844	cmd.exe	135
PID 1148 wrote to memory of 3636	1148	cmd.exe	136
PID 3636 wrote to memory of 4152	3636	cmd.exe	137
PID 1148 wrote to memory of 2612	1148	cmd.exe	138
PID 1148 wrote to memory of 5984	1148	cmd.exe	139

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\untitled.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\system32\mode.com
  mode con: cols=70 lines=20
  2⤵
  PID:3412
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4972
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1120
- C:\Windows\system32\msg.exe
  msg * "You've been trolled man."
  2⤵
  PID:5356
- C:\Windows\system32\cmd.exe
  cmd /c "color 0C & title LOL & echo. & echo L O L & echo. & timeout /t 2 /nobreak >nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:832
- C:\Windows\system32\cmd.exe
  cmd /c "color 0C & title LOL & echo. & echo L O L & echo. & timeout /t 2 /nobreak >nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2384
- C:\Windows\system32\cmd.exe
  cmd /c "color 0C & title LOL & echo. & echo L O L & echo. & timeout /t 2 /nobreak >nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4164
- C:\Windows\system32\cmd.exe
  cmd /c "color 0C & title LOL & echo. & echo L O L & echo. & timeout /t 2 /nobreak >nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1688
- C:\Windows\system32\cmd.exe
  cmd /c "color 0C & title LOL & echo. & echo L O L & echo. & timeout /t 2 /nobreak >nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5512
- C:\Windows\system32\cmd.exe
  cmd /c "color 0C & title LOL & echo. & echo L O L & echo. & timeout /t 2 /nobreak >nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:504
- C:\Windows\system32\cmd.exe
  cmd /c "color 0C & title LOL & echo. & echo L O L & echo. & timeout /t 2 /nobreak >nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1352
- C:\Windows\system32\cmd.exe
  cmd /c "color 0C & title LOL & echo. & echo L O L & echo. & timeout /t 2 /nobreak >nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5892
- C:\Windows\system32\cmd.exe
  cmd /c "color 0C & title LOL & echo. & echo L O L & echo. & timeout /t 2 /nobreak >nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2036
- C:\Windows\system32\cmd.exe
  cmd /c "color 0C & title LOL & echo. & echo L O L & echo. & timeout /t 2 /nobreak >nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3760
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2160
- C:\Windows\system32\cmd.exe
  cmd /c scrnsave.scr /s
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\system32\scrnsave.scr
    scrnsave.scr /s
    3⤵
    PID:4812
- C:\Windows\system32\cmd.exe
  cmd /c scrnsave.scr /s
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Windows\system32\scrnsave.scr
    scrnsave.scr /s
    3⤵
    PID:2252
- C:\Windows\system32\cmd.exe
  cmd /c scrnsave.scr /s
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\system32\scrnsave.scr
    scrnsave.scr /s
    3⤵
    PID:5952
- C:\Windows\system32\cmd.exe
  cmd /c scrnsave.scr /s
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\system32\scrnsave.scr
    scrnsave.scr /s
    3⤵
    PID:4412
- C:\Windows\system32\cmd.exe
  cmd /c scrnsave.scr /s
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\system32\scrnsave.scr
    scrnsave.scr /s
    3⤵
    PID:4088
- C:\Windows\system32\cmd.exe
  cmd /c scrnsave.scr /s
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\system32\scrnsave.scr
    scrnsave.scr /s
    3⤵
    PID:4152
- C:\Windows\system32\timeout.exe
  timeout /t 2 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2612
- C:\Windows\system32\taskkill.exe
  taskkill /IM svchost.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads