0b0164b21cb3542187ab2b680ea37d96bb0dceffecbbd3320d822a7fda534db9

Analysis

user interaction
yes
max time kernel
18s
max time network
8s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Service Disabler.bat
Size 2KB
Sample261027-3a7vrsef86
SHA256 0b0164b21cb3542187ab2b680ea37d96bb0dceffecbbd3320d822a7fda534db9
MD5 7d6363cc86371961a49e1d31f37d4a31
SHA1 4b5ce3cce3d38a5b898fec7a2b43493df1351a28
SHA512 0bbb0ccf40028b40e96d09af9b1eda4e8cc937a8b97689b240d8d2c40103f05bd603218241159e2414ae67173bd7aa056a994810ff8f8aadf0d572203e477eae
TLSH
T1EC41522135816D770F520A6689835D40FB580387A2793AFC36FB62A856CFF8DC94BA25
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 62 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3700	sc.exe
1048	sc.exe
2032	sc.exe
4524	sc.exe
6120	sc.exe
3316	sc.exe
3000	sc.exe
1980	sc.exe
2264	sc.exe
4148	sc.exe
4324	sc.exe
3284	sc.exe
5664	sc.exe
3940	sc.exe
548	sc.exe
5600	sc.exe
5876	sc.exe
4488	sc.exe
2668	sc.exe
3432	sc.exe
4880	sc.exe
3292	sc.exe
2660	sc.exe
5888	sc.exe
4864	sc.exe
1216	sc.exe
3224	sc.exe
2900	sc.exe
5712	sc.exe
2916	sc.exe
1472	sc.exe
4256	sc.exe
4916	sc.exe
1936	sc.exe
2404	sc.exe
5356	sc.exe
4512	sc.exe
2688	sc.exe
5172	sc.exe
4624	sc.exe
4508	sc.exe
5836	sc.exe
480	sc.exe
2652	sc.exe
2860	sc.exe
4884	sc.exe
4088	sc.exe
4808	sc.exe
4948	sc.exe
3920	sc.exe
3696	sc.exe
4840	sc.exe
5792	sc.exe
3164	sc.exe
1124	sc.exe
2952	sc.exe
3500	sc.exe
3548	sc.exe
4612	sc.exe
612	sc.exe
1932	sc.exe
1408	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4480	cmd.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 4324	4480	cmd.exe	90
PID 4480 wrote to memory of 2688	4480	cmd.exe	91
PID 4480 wrote to memory of 4880	4480	cmd.exe	92
PID 4480 wrote to memory of 4088	4480	cmd.exe	93
PID 4480 wrote to memory of 5600	4480	cmd.exe	94
PID 4480 wrote to memory of 3548	4480	cmd.exe	95
PID 4480 wrote to memory of 3292	4480	cmd.exe	96
PID 4480 wrote to memory of 1124	4480	cmd.exe	97
PID 4480 wrote to memory of 3700	4480	cmd.exe	98
PID 4480 wrote to memory of 3284	4480	cmd.exe	99
PID 4480 wrote to memory of 1216	4480	cmd.exe	100
PID 4480 wrote to memory of 5172	4480	cmd.exe	101
PID 4480 wrote to memory of 4148	4480	cmd.exe	102
PID 4480 wrote to memory of 1936	4480	cmd.exe	103
PID 4480 wrote to memory of 5664	4480	cmd.exe	104
PID 4480 wrote to memory of 2404	4480	cmd.exe	105
PID 4480 wrote to memory of 3316	4480	cmd.exe	106
PID 4480 wrote to memory of 2952	4480	cmd.exe	107
PID 4480 wrote to memory of 612	4480	cmd.exe	108
PID 4480 wrote to memory of 5876	4480	cmd.exe	109
PID 4480 wrote to memory of 3940	4480	cmd.exe	110
PID 4480 wrote to memory of 5356	4480	cmd.exe	111
PID 4480 wrote to memory of 4624	4480	cmd.exe	112
PID 4480 wrote to memory of 1932	4480	cmd.exe	113
PID 4480 wrote to memory of 4488	4480	cmd.exe	114
PID 4480 wrote to memory of 2668	4480	cmd.exe	115
PID 4480 wrote to memory of 4840	4480	cmd.exe	116
PID 4480 wrote to memory of 2660	4480	cmd.exe	117
PID 4480 wrote to memory of 4808	4480	cmd.exe	118
PID 4480 wrote to memory of 3224	4480	cmd.exe	119
PID 4480 wrote to memory of 4948	4480	cmd.exe	120
PID 4480 wrote to memory of 4524	4480	cmd.exe	121
PID 4480 wrote to memory of 3000	4480	cmd.exe	122
PID 4480 wrote to memory of 2900	4480	cmd.exe	123
PID 4480 wrote to memory of 5792	4480	cmd.exe	124
PID 4480 wrote to memory of 3164	4480	cmd.exe	125
PID 4480 wrote to memory of 4512	4480	cmd.exe	126
PID 4480 wrote to memory of 4508	4480	cmd.exe	127
PID 4480 wrote to memory of 1048	4480	cmd.exe	128
PID 4480 wrote to memory of 2916	4480	cmd.exe	129
PID 4480 wrote to memory of 5888	4480	cmd.exe	130
PID 4480 wrote to memory of 1472	4480	cmd.exe	131
PID 4480 wrote to memory of 548	4480	cmd.exe	132
PID 4480 wrote to memory of 4864	4480	cmd.exe	133
PID 4480 wrote to memory of 1980	4480	cmd.exe	134
PID 4480 wrote to memory of 3920	4480	cmd.exe	135
PID 4480 wrote to memory of 4256	4480	cmd.exe	136
PID 4480 wrote to memory of 6120	4480	cmd.exe	137
PID 4480 wrote to memory of 5836	4480	cmd.exe	138
PID 4480 wrote to memory of 5712	4480	cmd.exe	139
PID 4480 wrote to memory of 3500	4480	cmd.exe	140
PID 4480 wrote to memory of 3432	4480	cmd.exe	141
PID 4480 wrote to memory of 480	4480	cmd.exe	142
PID 4480 wrote to memory of 4612	4480	cmd.exe	143
PID 4480 wrote to memory of 2652	4480	cmd.exe	144
PID 4480 wrote to memory of 2032	4480	cmd.exe	145
PID 4480 wrote to memory of 2860	4480	cmd.exe	146
PID 4480 wrote to memory of 3696	4480	cmd.exe	147
PID 4480 wrote to memory of 4884	4480	cmd.exe	148
PID 4480 wrote to memory of 1408	4480	cmd.exe	149
PID 4480 wrote to memory of 2264	4480	cmd.exe	150
PID 4480 wrote to memory of 4916	4480	cmd.exe	151

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Service Disabler.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\system32\sc.exe
  sc config ""diagnosticshub.standardcollector.service"" start= disabled
  2⤵
  - Launches sc.exe
  PID:4324
- C:\Windows\system32\sc.exe
  sc config ""DiagTrack"" start= disabled
  2⤵
  - Launches sc.exe
  PID:2688
- C:\Windows\system32\sc.exe
  sc config ""dmwappushservice"" start= disabled
  2⤵
  - Launches sc.exe
  PID:4880
- C:\Windows\system32\sc.exe
  sc config ""lfsvc"" start= disabled
  2⤵
  - Launches sc.exe
  PID:4088
- C:\Windows\system32\sc.exe
  sc config ""MapsBroker"" start= disabled
  2⤵
  - Launches sc.exe
  PID:5600
- C:\Windows\system32\sc.exe
  sc config ""NetTcpPortSharing"" start= disabled
  2⤵
  - Launches sc.exe
  PID:3548
- C:\Windows\system32\sc.exe
  sc config ""RemoteAccess"" start= disabled
  2⤵
  - Launches sc.exe
  PID:3292
- C:\Windows\system32\sc.exe
  sc config ""RemoteRegistry"" start= disabled
  2⤵
  - Launches sc.exe
  PID:1124
- C:\Windows\system32\sc.exe
  sc config ""SharedAccess"" start= disabled
  2⤵
  - Launches sc.exe
  PID:3700
- C:\Windows\system32\sc.exe
  sc config ""TrkWks"" start= disabled
  2⤵
  - Launches sc.exe
  PID:3284
- C:\Windows\system32\sc.exe
  sc config ""WbioSrvc"" start= disabled
  2⤵
  - Launches sc.exe
  PID:1216
- C:\Windows\system32\sc.exe
  sc config ""ndu"" start= disabled
  2⤵
  - Launches sc.exe
  PID:5172
- C:\Windows\system32\sc.exe
  sc config ""WerSvc"" start= disabled
  2⤵
  - Launches sc.exe
  PID:4148
- C:\Windows\system32\sc.exe
  sc config ""Spooler"" start= disabled
  2⤵
  - Launches sc.exe
  PID:1936
- C:\Windows\system32\sc.exe
  sc config ""Fax"" start= disabled
  2⤵
  - Launches sc.exe
  PID:5664
- C:\Windows\system32\sc.exe
  sc config ""fhsvc"" start= disabled
  2⤵
  - Launches sc.exe
  PID:2404
- C:\Windows\system32\sc.exe
  sc config ""gupdate"" start= disabled
  2⤵
  - Launches sc.exe
  PID:3316
- C:\Windows\system32\sc.exe
  sc config ""gupdatem"" start= disabled
  2⤵
  - Launches sc.exe
  PID:2952
- C:\Windows\system32\sc.exe
  sc config ""stisvc"" start= disabled
  2⤵
  - Launches sc.exe
  PID:612
- C:\Windows\system32\sc.exe
  sc config ""AJRouter"" start= disabled
  2⤵
  - Launches sc.exe
  PID:5876
- C:\Windows\system32\sc.exe
  sc config ""MSDTC"" start= disabled
  2⤵
  - Launches sc.exe
  PID:3940
- C:\Windows\system32\sc.exe
  sc config ""WpcMonSvc"" start= disabled
  2⤵
  - Launches sc.exe
  PID:5356
- C:\Windows\system32\sc.exe
  sc config ""PhoneSvc"" start= disabled
  2⤵
  - Launches sc.exe
  PID:4624
- C:\Windows\system32\sc.exe
  sc config ""PcaSvc"" start= disabled
  2⤵
  - Launches sc.exe
  PID:1932
- C:\Windows\system32\sc.exe
  sc config ""WPDBusEnum"" start= disabled
  2⤵
  - Launches sc.exe
  PID:4488
- C:\Windows\system32\sc.exe
  sc config ""seclogon"" start= disabled
  2⤵
  - Launches sc.exe
  PID:2668
- C:\Windows\system32\sc.exe
  sc config ""lmhosts"" start= disabled
  2⤵
  - Launches sc.exe
  PID:4840
- C:\Windows\system32\sc.exe
  sc config ""wisvc"" start= disabled
  2⤵
  - Launches sc.exe
  PID:2660
- C:\Windows\system32\sc.exe
  sc config ""FontCache"" start= disabled
  2⤵
  - Launches sc.exe
  PID:4808
- C:\Windows\system32\sc.exe
  sc config ""RetailDemo"" start= disabled
  2⤵
  - Launches sc.exe
  PID:3224
- C:\Windows\system32\sc.exe
  sc config ""ALG"" start= disabled
  2⤵
  - Launches sc.exe
  PID:4948
- C:\Windows\system32\sc.exe
  sc config ""SCardSvr"" start= disabled
  2⤵
  - Launches sc.exe
  PID:4524
- C:\Windows\system32\sc.exe
  sc config ""SCPolicySvc"" start= disabled
  2⤵
  - Launches sc.exe
  PID:3000
- C:\Windows\system32\sc.exe
  sc config ""ScDeviceEnum"" start= disabled
  2⤵
  - Launches sc.exe
  PID:2900
- C:\Windows\system32\sc.exe
  sc config ""MessagingService_34048"" start= disabled
  2⤵
  - Launches sc.exe
  PID:5792
- C:\Windows\system32\sc.exe
  sc config ""EntAppSvc"" start= disabled
  2⤵
  - Launches sc.exe
  PID:3164
- C:\Windows\system32\sc.exe
  sc config ""Browser"" start= disabled
  2⤵
  - Launches sc.exe
  PID:4512
- C:\Windows\system32\sc.exe
  sc config ""BDESVC"" start= disabled
  2⤵
  - Launches sc.exe
  PID:4508
- C:\Windows\system32\sc.exe
  sc config ""iphlpsvc"" start= disabled
  2⤵
  - Launches sc.exe
  PID:1048
- C:\Windows\system32\sc.exe
  sc config ""edgeupdate"" start= disabled
  2⤵
  - Launches sc.exe
  PID:2916
- C:\Windows\system32\sc.exe
  sc config ""MicrosoftEdgeElevationService"" start= disabled
  2⤵
  - Launches sc.exe
  PID:5888
- C:\Windows\system32\sc.exe
  sc config ""edgeupdatem"" start= disabled
  2⤵
  - Launches sc.exe
  PID:1472
- C:\Windows\system32\sc.exe
  sc config ""SEMgrSvc"" start= disabled
  2⤵
  - Launches sc.exe
  PID:548
- C:\Windows\system32\sc.exe
  sc config ""PerfHost"" start= disabled
  2⤵
  - Launches sc.exe
  PID:4864
- C:\Windows\system32\sc.exe
  sc config ""BcastDVRUserService_48486de"" start= disabled
  2⤵
  - Launches sc.exe
  PID:1980
- C:\Windows\system32\sc.exe
  sc config ""WpnService"" start= disabled
  2⤵
  - Launches sc.exe
  PID:3920
- C:\Windows\system32\sc.exe
  sc config ""DoSvc"" start= disabled
  2⤵
  - Launches sc.exe
  PID:4256
- C:\Windows\system32\sc.exe
  sc config ""SNMPTrap"" start= disabled
  2⤵
  - Launches sc.exe
  PID:6120
- C:\Windows\system32\sc.exe
  sc config ""SECOMNService"" start= disabled
  2⤵
  - Launches sc.exe
  PID:5836
- C:\Windows\system32\sc.exe
  sc config ""autotimesvc"" start= disabled
  2⤵
  - Launches sc.exe
  PID:5712
- C:\Windows\system32\sc.exe
  sc config ""tzautoupdate"" start= disabled
  2⤵
  - Launches sc.exe
  PID:3500
- C:\Windows\system32\sc.exe
  sc config ""BcastDVRUserService_34048"" start= disabled
  2⤵
  - Launches sc.exe
  PID:3432
- C:\Windows\system32\sc.exe
  sc config ""PenService_34048"" start= disabled
  2⤵
  - Launches sc.exe
  PID:480
- C:\Windows\system32\sc.exe
  sc config ""tapisrv"" start= disabled
  2⤵
  - Launches sc.exe
  PID:4612
- C:\Windows\system32\sc.exe
  sc config ""HvHost"" start= disabled
  2⤵
  - Launches sc.exe
  PID:2652
- C:\Windows\system32\sc.exe
  sc config ""vmickvpexchange"" start= disabled
  2⤵
  - Launches sc.exe
  PID:2032
- C:\Windows\system32\sc.exe
  sc config ""vmicguestinterface"" start= disabled
  2⤵
  - Launches sc.exe
  PID:2860
- C:\Windows\system32\sc.exe
  sc config ""vmicshutdown"" start= disabled
  2⤵
  - Launches sc.exe
  PID:3696
- C:\Windows\system32\sc.exe
  sc config ""vmicheartbeat"" start= disabled
  2⤵
  - Launches sc.exe
  PID:4884
- C:\Windows\system32\sc.exe
  sc config ""vmicvmsession"" start= disabled
  2⤵
  - Launches sc.exe
  PID:1408
- C:\Windows\system32\sc.exe
  sc config ""vmicrdv"" start= disabled
  2⤵
  - Launches sc.exe
  PID:2264
- C:\Windows\system32\sc.exe
  sc config ""vmictimesync"" start= disabled
  2⤵
  - Launches sc.exe
  PID:4916