d9543563ea3f0c79d3066e6eb0947df8a179faeabada32475da82930bb73f33f

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 10:50

Target
service-remove.bat
Size 141B
Sample261027-mxff2adc64
SHA256 d9543563ea3f0c79d3066e6eb0947df8a179faeabada32475da82930bb73f33f
MD5 85c3edc18f26f83c579ac86ae887a090
SHA1 9774505f25970f02feb41c698ba0f83e4736ff68
SHA512 0d4f3764349dbf98b7c056468ea498e4272b990fa19e364450e13e551be972768d4a575bfebb9537760ed49aab0a77b339ce4f989fad81086d192956b32bfd2e
TLSH
T111C08C1F38039C201087A0C250F33045AA80CA574CA7BEC09CD3A138AC80548220540A
MD5 SHA1 SHA512 TLSH

Score

7^/10

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1612	sc.exe
4432	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
4232	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1244	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	taskkill.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 4432	4232	cmd.exe	87
PID 4232 wrote to memory of 1612	4232	cmd.exe	88
PID 4232 wrote to memory of 1244	4232	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\service-remove.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\system32\sc.exe
  sc stop zapret2
  2⤵
  - Launches sc.exe
  PID:4432
- C:\Windows\system32\sc.exe
  sc delete zapret2
  2⤵
  - Launches sc.exe
  PID:1612
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM winws2.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1244