66e27d5d0abf887a7e66f4729067bab092e83e7d76645f73177f0fc7a6070bd5

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
command.bat
Size 36B
Sample260929-rhaz8ahf49
SHA256 66e27d5d0abf887a7e66f4729067bab092e83e7d76645f73177f0fc7a6070bd5
MD5 12a3158bdc4242aafb3eda4d599cf288
SHA1 e9e625cf356b056c7941b3e896d750abbe6c837c
SHA512 508595e6f5ab876a7fa24d9fb4c9864f231000a35a8fef3ebee98c9f71cdae4775bd0c533362b3e5a3ed513f863e0cf68712bf4231203740a8e50898d8d86d88
MD5 SHA1 SHA512

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2456	cmd.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3292	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3292	msiexec.exe
Token: SeSecurityPrivilege	2896	msiexec.exe
Token: SeCreateTokenPrivilege	3292	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3292	msiexec.exe
Token: SeLockMemoryPrivilege	3292	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3292	msiexec.exe
Token: SeMachineAccountPrivilege	3292	msiexec.exe
Token: SeTcbPrivilege	3292	msiexec.exe
Token: SeSecurityPrivilege	3292	msiexec.exe
Token: SeTakeOwnershipPrivilege	3292	msiexec.exe
Token: SeLoadDriverPrivilege	3292	msiexec.exe
Token: SeSystemProfilePrivilege	3292	msiexec.exe
Token: SeSystemtimePrivilege	3292	msiexec.exe
Token: SeProfSingleProcessPrivilege	3292	msiexec.exe
Token: SeIncBasePriorityPrivilege	3292	msiexec.exe
Token: SeCreatePagefilePrivilege	3292	msiexec.exe
Token: SeCreatePermanentPrivilege	3292	msiexec.exe
Token: SeBackupPrivilege	3292	msiexec.exe
Token: SeRestorePrivilege	3292	msiexec.exe
Token: SeShutdownPrivilege	3292	msiexec.exe
Token: SeDebugPrivilege	3292	msiexec.exe
Token: SeAuditPrivilege	3292	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3292	msiexec.exe
Token: SeChangeNotifyPrivilege	3292	msiexec.exe
Token: SeRemoteShutdownPrivilege	3292	msiexec.exe
Token: SeUndockPrivilege	3292	msiexec.exe
Token: SeSyncAgentPrivilege	3292	msiexec.exe
Token: SeEnableDelegationPrivilege	3292	msiexec.exe
Token: SeManageVolumePrivilege	3292	msiexec.exe
Token: SeImpersonatePrivilege	3292	msiexec.exe
Token: SeCreateGlobalPrivilege	3292	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3292	msiexec.exe
2896	msiexec.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 3292	2456	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\command.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\system32\msiexec.exe
  msiexec /i C:\Users\Admin\AppData\Local\Temp\x.msi /quiet /qn
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3292

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads