04471a11ce60e78dee07a475143951eb350efae2bb8c1cb43e476fa5e3b3e912

Analysis

user interaction
yes
max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
The Mystery.bat
Size 6KB
Sample261011-3fzrcabc35
SHA256 04471a11ce60e78dee07a475143951eb350efae2bb8c1cb43e476fa5e3b3e912
MD5 0be81f518e57435009fcc3a828cf9b4a
SHA1 a74351974a29b79fe7ac1e1c0e187255b7fb899e
SHA512 f729cba5b694f6ac3bbf4082f2084e5ee064319da9f37851fdcc64a920a3ea0c56446f0e376a17d95de3cf6920ff8b4187cbc8e3dc5118ab4222d26c45eef91e
SSDEEP 96:vFKRjWqMiR79x6Ia+snY048qGmq0wpXw74hvkejWnG0nsCStzCU:vF4aqY+41qGPTpUg8SWnrnVU
TLSH
T1D2D150273560E50290B196A0EC7994A1F21EE3CBAE04BF84749FA170573A3C2737D5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2960	cmd.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
1648	taskkill.exe
4324	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	taskkill.exe
Token: SeDebugPrivilege	4324	taskkill.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 1312	2960	cmd.exe	90
PID 2960 wrote to memory of 5312	2960	cmd.exe	91
PID 2960 wrote to memory of 1648	2960	cmd.exe	92
PID 2960 wrote to memory of 4324	2960	cmd.exe	94
PID 2960 wrote to memory of 1824	2960	cmd.exe	95
PID 2960 wrote to memory of 5212	2960	cmd.exe	96
PID 2960 wrote to memory of 2488	2960	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\The Mystery.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\system32\reg.exe
  reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager"
  2⤵
  PID:1312
- C:\Windows\system32\find.exe
  find "Debug"
  2⤵
  PID:5312
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1648
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4324
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:1824
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowTaskbar /t REG_DWORD /d 0 /f
  2⤵
  PID:5212
- C:\Windows\system32\mode.com
  mode con: cols=200 lines=200
  2⤵
  PID:2488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

full.bat

Path C:\Users\Admin\AppData\Local\Temp\full.bat
Size 31B
SHA256 ca355fbd7b5955638723e28a54768bb064d02af886d02e5894bb1fe156bac95b
MD5 70dddf54e921ab6118f8abe8cfe75edf
SHA1 1dabdcd1d9cca11bea4f825165358c7c9e0e4776
SHA512 3ddcceb3d15266b7ae6001e980d0bac6aedc0047de90af03c04f85490f635bf40b59872690a39e8b07c1cc4076200246085c82edcf8f74d84dbb6e44af1ffed4
MD5 SHA1 SHA512

Submit Download