5b3a41434393652ad3b6e8694aa5a2101afa41fdbe8fb96ded21e9285edd7a52

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UserSecurityManager/build.bat
Size 1KB
Sample261027-ec6tgs1vcs
SHA256 5b3a41434393652ad3b6e8694aa5a2101afa41fdbe8fb96ded21e9285edd7a52
MD5 f31bdd024b6283d401d29e76e6b5a50a
SHA1 9b82baddeac3dbc77c47ccc9b150174bede23182
SHA512 f32b0a26447e016b73d84721c5614de5549de5a13bd3802884b36514691e1ea14128af6253de14f35933972b28498d2d81fe27f4ec16d87c53de1320befb9dac
TLSH
T18B11ADDA77C7052514475B917B560E6BED7FD0A5E388080E30C724C0565EF28623A7AC
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3912	cmd.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeBackupPrivilege	3768	Robocopy.exe
Token: SeRestorePrivilege	3768	Robocopy.exe
Token: SeSecurityPrivilege	3768	Robocopy.exe
Token: SeTakeOwnershipPrivilege	3768	Robocopy.exe
Token: SeBackupPrivilege	4192	Robocopy.exe
Token: SeRestorePrivilege	4192	Robocopy.exe
Token: SeSecurityPrivilege	4192	Robocopy.exe
Token: SeTakeOwnershipPrivilege	4192	Robocopy.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 3768	3912	cmd.exe	86
PID 3912 wrote to memory of 4192	3912	cmd.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\UserSecurityManager\build.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\system32\Robocopy.exe
  robocopy "c:\WebConnectionProjects\UserSecurityManager"\data data /MIR
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3768
- C:\Windows\system32\Robocopy.exe
  robocopy "c:\WebConnectionProjects\UserSecurityManager"\web web /MIR
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads