1e97a4a0981e6a78945887c608f3f18a23363ddd3abce272048eb0b81ee6ebc5

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Activator.bat
Size 13KB
Sample261027-datwgah131
SHA256 1e97a4a0981e6a78945887c608f3f18a23363ddd3abce272048eb0b81ee6ebc5
MD5 775468869aa3e849592658ebdd835fc9
SHA1 075221cc9c07c432831ea6973fdf1008db32a135
SHA512 8163bd9bb765d9fc9fbbf791c942bd21c0c3c110a363fc0c02a9afaf33b03d64df76a5b4dea15fa79189edffbf22006c56b70d81694634e6146a6b86c1ec5a6b
SSDEEP 192:Ct2VeGIcF0ALjQZpTGsm+shbGT0jvM14jL0rEXYTd1YyE6LYRhKQpcMuQsts6Gyo:I24BUEmitIuTXy
TLSH
T1BD52531324A350623B7F46FB892AB005F78552E74A4C4A247DAFD05CEFFE4CAD91E909
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3120	cscript.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3104	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 4556	3104	cmd.exe	90
PID 3104 wrote to memory of 4152	3104	cmd.exe	91
PID 3104 wrote to memory of 3120	3104	cmd.exe	92
PID 3104 wrote to memory of 4848	3104	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Activator.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:4556
- C:\Windows\system32\mode.com
  mode con: cols=118 lines=10
  2⤵
  PID:4152
- C:\Windows\system32\cscript.exe
  CSCRIPT //NoLogo "C:\Users\Admin\AppData\Local\Temp.\sleep.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3120
- C:\Windows\system32\mode.com
  mode con: cols=150 lines=10
  2⤵
  PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sleep.vbs

Path C:\Users\Admin\AppData\Local\Temp\sleep.vbs
Size 21B
SHA256 4549dfc21037fa8985b9ece65c559a30ccf533b07a3c2cb229223c28ba459723
MD5 30629af30d5a621a55ed835823776842
SHA1 17137aa1cebdb199302a0b8d23e58dbbbc7de552
SHA512 16b34d9c979052aa13c84a8bbdc1f08f3b2e54256654830e564f61448ce699531985403cd30641ac60beaa8e09e6ef695d7c2153a8980fa115cba267f83fa5cf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads