Analysis
- user interaction
yes - max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 12:41
Static task
static1
Behavioral task
behavioral1
Sample
deepseek_batch_20261002_ddd3ce.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
deepseek_batch_20261002_ddd3ce.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target deepseek_batch_20261002_ddd3ce.bat
- Size 17KB
- Sample261002-pw76rssflc
- SHA256 fd88b033616ad713dbebbdaa2f1a3b11a9a474e2e864b7d18bddccdebb7fd56a
- MD5 d23bbd97d239c0ee9024b8b04ebe294a
- SHA1 79eac16472365d47d2ff2b4f140f2add6a0ed42c
- SHA512 8d43a8e7b57b3e0955e5c16327229e2f8009e4c35074d3b318fd071e6f5a656552ce74e69f10f78449aff19faae164d407d2dcafbff25334b923997e9b6c7c7d
- SSDEEP 384:0Ztp+gisNQegxMRVg6JUluV++5gH2FHoBCpCVaFOX0eg2v4wsRsaATXbSpR+iuqa:+tfwMfRdMGqsFs
- TLSH T1F682232378244C2E9555E264A8E78807F7E480C710023FD5B9EB21A9277BB8953BDFDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
-
pid Process 4284 powershell.exe 5020 powershell.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ powershell.exe \??\F:\ powershell.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4720 cmd.exe 4996 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000032ed1b0a2a5ec3f10000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380132ed1b0a0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410132ed1b0a000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e332ed1b0a00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e632ed1b0a00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1100 WMIC.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1100 WMIC.exe 1100 WMIC.exe 1100 WMIC.exe 1100 WMIC.exe 4284 powershell.exe 4284 powershell.exe 5020 powershell.exe 5020 powershell.exe - Suspicious use of AdjustPrivilegeToken 55 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1100 WMIC.exe Token: SeSecurityPrivilege 1100 WMIC.exe Token: SeTakeOwnershipPrivilege 1100 WMIC.exe Token: SeLoadDriverPrivilege 1100 WMIC.exe Token: SeSystemProfilePrivilege 1100 WMIC.exe Token: SeSystemtimePrivilege 1100 WMIC.exe Token: SeProfSingleProcessPrivilege 1100 WMIC.exe Token: SeIncBasePriorityPrivilege 1100 WMIC.exe Token: SeCreatePagefilePrivilege 1100 WMIC.exe Token: SeBackupPrivilege 1100 WMIC.exe Token: SeRestorePrivilege 1100 WMIC.exe Token: SeShutdownPrivilege 1100 WMIC.exe Token: SeDebugPrivilege 1100 WMIC.exe Token: SeSystemEnvironmentPrivilege 1100 WMIC.exe Token: SeRemoteShutdownPrivilege 1100 WMIC.exe Token: SeUndockPrivilege 1100 WMIC.exe Token: SeManageVolumePrivilege 1100 WMIC.exe Token: 33 1100 WMIC.exe Token: 34 1100 WMIC.exe Token: 35 1100 WMIC.exe Token: 36 1100 WMIC.exe Token: SeIncreaseQuotaPrivilege 1100 WMIC.exe Token: SeSecurityPrivilege 1100 WMIC.exe Token: SeTakeOwnershipPrivilege 1100 WMIC.exe Token: SeLoadDriverPrivilege 1100 WMIC.exe Token: SeSystemProfilePrivilege 1100 WMIC.exe Token: SeSystemtimePrivilege 1100 WMIC.exe Token: SeProfSingleProcessPrivilege 1100 WMIC.exe Token: SeIncBasePriorityPrivilege 1100 WMIC.exe Token: SeCreatePagefilePrivilege 1100 WMIC.exe Token: SeBackupPrivilege 1100 WMIC.exe Token: SeRestorePrivilege 1100 WMIC.exe Token: SeShutdownPrivilege 1100 WMIC.exe Token: SeDebugPrivilege 1100 WMIC.exe Token: SeSystemEnvironmentPrivilege 1100 WMIC.exe Token: SeRemoteShutdownPrivilege 1100 WMIC.exe Token: SeUndockPrivilege 1100 WMIC.exe Token: SeManageVolumePrivilege 1100 WMIC.exe Token: 33 1100 WMIC.exe Token: 34 1100 WMIC.exe Token: 35 1100 WMIC.exe Token: 36 1100 WMIC.exe Token: SeDebugPrivilege 4284 powershell.exe Token: SeDebugPrivilege 5020 powershell.exe Token: SeBackupPrivilege 4344 vssvc.exe Token: SeRestorePrivilege 4344 vssvc.exe Token: SeAuditPrivilege 4344 vssvc.exe Token: SeBackupPrivilege 2568 srtasks.exe Token: SeRestorePrivilege 2568 srtasks.exe Token: SeSecurityPrivilege 2568 srtasks.exe Token: SeTakeOwnershipPrivilege 2568 srtasks.exe Token: SeBackupPrivilege 2568 srtasks.exe Token: SeRestorePrivilege 2568 srtasks.exe Token: SeSecurityPrivilege 2568 srtasks.exe Token: SeTakeOwnershipPrivilege 2568 srtasks.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4720 wrote to memory of 5004 4720 cmd.exe 90 PID 4720 wrote to memory of 4980 4720 cmd.exe 91 PID 4720 wrote to memory of 2704 4720 cmd.exe 92 PID 2704 wrote to memory of 5520 2704 net.exe 93 PID 4720 wrote to memory of 4996 4720 cmd.exe 94 PID 4996 wrote to memory of 1100 4996 cmd.exe 95 PID 4996 wrote to memory of 5024 4996 cmd.exe 96 PID 4720 wrote to memory of 4284 4720 cmd.exe 98 PID 4720 wrote to memory of 5020 4720 cmd.exe 100 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\deepseek_batch_20261002_ddd3ce.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\system32\chcp.comchcp 4372⤵PID:5004
-
-
C:\Windows\system32\mode.commode con: cols=80 lines=352⤵PID:4980
-
-
C:\Windows\system32\net.exenet session2⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:5520
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic path win32_VideoController get name 2>nul | findstr /i "NVIDIA"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Reads the TCP/IP host and domain name from the registry
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1100
-
-
C:\Windows\system32\findstr.exefindstr /i "NVIDIA"3⤵PID:5024
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Enable-ComputerRestore -Drive 'C:\'"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4284
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Checkpoint-Computer -Description 'ToxiC Tweaker' -RestorePointType 'MODIFY_SETTINGS'"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4344
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
PID:2568
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 b4d2605b3421911dd23b203ceda3c674f6e4c59b93f9c9d10ef548e2461a3151
- MD5 e6a8d33648820752b04254098d837621
- SHA1 a24310e320c2b6dddfb808db69565d1ca0276e6d
- SHA512 01180b5c095bfa465388173f8e0b8d234982aa4e1589058889727894e15834c54b89c46f7ba8d26582841986db1e038fbe38f813ac75419995eb7e0891a6a432
- TLSH T114115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D144B83F59ADE61260
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ejixoii.1qy.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH