d9543563ea3f0c79d3066e6eb0947df8a179faeabada32475da82930bb73f33f

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 10:50

Target
service-remove.bat
Size 141B
Sample261027-mxff2adc64
SHA256 d9543563ea3f0c79d3066e6eb0947df8a179faeabada32475da82930bb73f33f
MD5 85c3edc18f26f83c579ac86ae887a090
SHA1 9774505f25970f02feb41c698ba0f83e4736ff68
SHA512 0d4f3764349dbf98b7c056468ea498e4272b990fa19e364450e13e551be972768d4a575bfebb9537760ed49aab0a77b339ce4f989fad81086d192956b32bfd2e
TLSH
T111C08C1F38039C201087A0C250F33045AA80CA574CA7BEC09CD3A138AC80548220540A
MD5 SHA1 SHA512 TLSH

Score

7^/10

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1884	sc.exe
5848	sc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
1092	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4328	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4328	taskkill.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1884	1092	cmd.exe	90
PID 1092 wrote to memory of 5848	1092	cmd.exe	91
PID 1092 wrote to memory of 4328	1092	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\service-remove.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\system32\sc.exe
  sc stop zapret2
  2⤵
  - Launches sc.exe
  PID:1884
- C:\Windows\system32\sc.exe
  sc delete zapret2
  2⤵
  - Launches sc.exe
  PID:5848
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM winws2.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4328