c0b342d196d65de8ad021869f81ecd82e1934ed22c3bbc21a6bcec46b97ba35d

Analysis

max time kernel
149s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
example.bat
Size 542B
Sample261027-dev94ah15z
SHA256 c0b342d196d65de8ad021869f81ecd82e1934ed22c3bbc21a6bcec46b97ba35d
MD5 cbdcd710a7291d06505973c0111f46d5
SHA1 f21a34345e05b1e17283d7543df8e6f0c7e53ddb
SHA512 71859ea22a3a941195e84006567a30a392dbdafe53c736adb5a29f94d615d7616dbdb5f6029abf050b690f04a8d74e77e0301cc2bd68d3023fb640a9a0f6d056
TLSH
T1BFF0C02D2300A14349394272F816B09DEC1401162B6B5C72278BE3B06DB70DFEEBA5C5
MD5 SHA1 SHA512 TLSH

Score

5^/10

execution ransomware

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2592	wscript.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4232	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3568	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1084	powershell.exe
1084	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1084	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 1084	4232	cmd.exe	90
PID 4232 wrote to memory of 2592	4232	cmd.exe	91
PID 4232 wrote to memory of 3568	4232	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\example.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -c (New-Object Media.SoundPlayer "$env:windir\Media\Windows Error.wav").PlaySync()
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1084
- C:\Windows\system32\wscript.exe
  wscript "C:\Users\Admin\AppData\Local\Temp\err.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2592
- C:\Windows\system32\notepad.exe
  notepad "C:\Users\Admin\AppData\Local\Temp\wavy_error.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

err.vbs

Path C:\Users\Admin\AppData\Local\Temp\err.vbs
Size 62B
SHA256 c94160da267ccd02cd8ebcdec5fd263016d42454b72ece6ba5d13c36b93a2f90
MD5 1117360c582f56e9a9093b12dad6322b
SHA1 08595e1efbe03426ec5b8affb9beae975327e2ee
SHA512 aee2f391056064655c4fff52f29d2be6c58b26659e10ab7ea12330885843465fdb46ab2caa67159eabc3ad72928db66bf512355c3e8c07b5c605695405d926d1
TLSH
T1AAA00256332955EAD16893075907E8DB3524E08D4A6E83E9069801556954442CEE2293
MD5 SHA1 SHA512 TLSH

Submit Download

wavy_error.txt

Path C:\Users\Admin\AppData\Local\Temp\wavy_error.txt
Size 97B
SHA256 817cd69276748b1a62dd8a384606df86fc8dd81e3b6b21fc940c6f137a8a97ff
MD5 9a482e8d514270fd62dd85be32a897da
SHA1 5a38be4c74699e0946dd151fdc778c03d50bccb8
SHA512 9baf30a1df5abb64f47fb4f11156e4ee6cdca0247ea43290693791adef138b838b349d699f8b2b32bbc1d52608eea2dd34c881f00ed15d3b45f45d637f9be4a4
TLSH
T160B001AC6620509268864288EC05563D5CEC05226AD36959AC6BF3119D7943D1599479
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1084-8-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/1084-5-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/1084-6-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/1084-7-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/1084-0-0x00007FFAEF64F000-0x00007FFAEF650000-memory.dmp

Download

memory/1084-9-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/1084-10-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/1084-11-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/1084-12-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/1084-15-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/1084-14-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download

memory/1084-4-0x0000020134C20000-0x0000020134C42000-memory.dmp

Download

memory/1084-3-0x00007FFAEF4C0000-0x00007FFAEFE64000-memory.dmp

Download