391adbca7452b9057d2d68d6d3f9059115aa834e1f04ff65cdeda7b7991b2438

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
reset_login_win/reset_login_win.bat
Size 866B
Sample261015-pl5mwstyet
SHA256 391adbca7452b9057d2d68d6d3f9059115aa834e1f04ff65cdeda7b7991b2438
MD5 afc2d170023f39ccc4ba99777598d451
SHA1 de55b55da3a5cf3d62a1f4a79a092a3b19e19062
SHA512 7d0cf7c9ffcf36a9a44e06f955163cef6f058f5a850f5fdbf10dcd96a1df38985d248a58b9294a9e73289db09d23950f10fc61180c1bdca10e6c80ef246051b9
TLSH
T15311C9076D47E603815AA1D1DA9E1680F10BE2179C7C4945710B30B8BF4420CE2BFBCF
MD5 SHA1 SHA512 TLSH

Score

5^/10

defense_evasion execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4964	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4980	cmd.exe
5752	cmd.exe

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
4552	taskkill.exe
3440	taskkill.exe
3816	taskkill.exe
1072	taskkill.exe
1584	taskkill.exe
1216	taskkill.exe
5496	taskkill.exe
4972	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings	WScript.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4972	taskkill.exe
Token: SeDebugPrivilege	4552	taskkill.exe
Token: SeDebugPrivilege	3440	taskkill.exe
Token: SeDebugPrivilege	3816	taskkill.exe
Token: SeDebugPrivilege	1072	taskkill.exe
Token: SeDebugPrivilege	1584	taskkill.exe
Token: SeDebugPrivilege	1216	taskkill.exe
Token: SeDebugPrivilege	5496	taskkill.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 4964	4980	cmd.exe	90
PID 4964 wrote to memory of 5752	4964	WScript.exe	91
PID 5752 wrote to memory of 4972	5752	cmd.exe	93
PID 5752 wrote to memory of 4552	5752	cmd.exe	95
PID 5752 wrote to memory of 3440	5752	cmd.exe	96
PID 5752 wrote to memory of 3816	5752	cmd.exe	97
PID 5752 wrote to memory of 1072	5752	cmd.exe	98
PID 5752 wrote to memory of 1584	5752	cmd.exe	99
PID 5752 wrote to memory of 1216	5752	cmd.exe	100
PID 5752 wrote to memory of 5496	5752	cmd.exe	101

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\reset_login_win\reset_login_win.bat"
1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\getadmin.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RESET_~1\RESET_~1.BAT" payload C:\Users\Admin\AppData\Local\Temp\RESET_~1\
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5752
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "AdSSO.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4972
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "AdAppMgrSvc.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4552
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "AutodeskDesktopApp.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3440
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "AdskLicensingAgent.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3816
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "ADPClientService.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1072
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "AdskIdentityManager.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1584
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "AccessCore.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1216
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im "AdskAccessUIHost.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

getadmin.vbs

Path C:\Users\Admin\AppData\Local\Temp\getadmin.vbs
Size 210B
SHA256 9868be06b855e79aca84d4febb5f3d89189077cffaca8894a84c7a5591be7e0c
MD5 7e2bd74adc8383581d674a4a7e3f5cea
SHA1 0e08834e01ba7e238bcef75a0b4ca5b2dff8c105
SHA512 ac509f4432c8de4d35a36b8ae1680cb46f60821d6f5a395ae82b7bac6941ac76ec10ce3a764b945ce3326f9bbca59ea93a978546abac0102e5ba746ef97f2535
TLSH
T1F2D01201548ACF2F294EB17B0576995C82B21A1F3F4A2AA0F70DC48C135945CBBC27CB
MD5 SHA1 SHA512 TLSH

Submit Download