fb7ee2e341f7e414a37720610fc130174e430f87dd9d9d85dcc3af0b9ad32752

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
grab-registry.bat
Size 3KB
Sample261030-can5jsgw2w
SHA256 fb7ee2e341f7e414a37720610fc130174e430f87dd9d9d85dcc3af0b9ad32752
MD5 40987b819a7b50c653c47e107065c590
SHA1 f877b9f8120fe3c9be5004b29d7d1fd4966f2b56
SHA512 554c24f2a65e286c81e4c4a1a9ace77d40443a4c37411b74577a24dfa060ef194c7849bc704027aefd360c26b5b965550c9d421d4677c1042f116391edec452b
TLSH
T1A46151197CC09AA1464C5392770EA3738E2B5166590C11BCF6AF139E13073C94BB89FE
MD5 SHA1 SHA512 TLSH

Score

9^/10

credential_access execution

Malware Config

Signatures

OS Credential Dumping: Security Account Manager 1 TTPs 2 IoCs

Malicious Registry Hive Dumping.

credential_access

Security Account Manager

T1003.002

pid	Process
2084	reg.exe
4804	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3860	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1276	cmd.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
4216	reg.exe
2736	reg.exe
4836	reg.exe
1712	reg.exe
2108	reg.exe
2252	reg.exe
5128	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3860	powershell.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeBackupPrivilege	4804	reg.exe
Token: SeBackupPrivilege	3192	reg.exe
Token: SeBackupPrivilege	4556	reg.exe
Token: SeBackupPrivilege	712	reg.exe
Token: SeBackupPrivilege	2084	reg.exe
Token: SeRestorePrivilege	4736	reg.exe
Token: SeRestorePrivilege	4744	reg.exe
Token: SeRestorePrivilege	1852	reg.exe
Token: SeRestorePrivilege	2436	reg.exe
Token: SeRestorePrivilege	4724	reg.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeRestorePrivilege	4156	reg.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2656	1276	cmd.exe	90
PID 2656 wrote to memory of 3836	2656	net.exe	91
PID 1276 wrote to memory of 4804	1276	cmd.exe	92
PID 1276 wrote to memory of 3192	1276	cmd.exe	93
PID 1276 wrote to memory of 4556	1276	cmd.exe	94
PID 1276 wrote to memory of 712	1276	cmd.exe	95
PID 1276 wrote to memory of 2084	1276	cmd.exe	96
PID 1276 wrote to memory of 4736	1276	cmd.exe	97
PID 1276 wrote to memory of 4744	1276	cmd.exe	98
PID 1276 wrote to memory of 2108	1276	cmd.exe	99
PID 1276 wrote to memory of 2252	1276	cmd.exe	100
PID 1276 wrote to memory of 5128	1276	cmd.exe	101
PID 1276 wrote to memory of 4216	1276	cmd.exe	102
PID 1276 wrote to memory of 2736	1276	cmd.exe	103
PID 1276 wrote to memory of 4836	1276	cmd.exe	104
PID 1276 wrote to memory of 1712	1276	cmd.exe	105
PID 1276 wrote to memory of 1852	1276	cmd.exe	106
PID 1276 wrote to memory of 2436	1276	cmd.exe	107
PID 1276 wrote to memory of 4724	1276	cmd.exe	108
PID 1276 wrote to memory of 3860	1276	cmd.exe	109
PID 1276 wrote to memory of 4156	1276	cmd.exe	110

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\grab-registry.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\system32\net.exe
  NET SESSIONS
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 SESSIONS
    3⤵
    PID:3836
- C:\Windows\system32\reg.exe
  REG SAVE HKLM\SYSTEM "registry\SYSTEM" /Y
  2⤵
  - OS Credential Dumping: Security Account Manager
  - Suspicious use of AdjustPrivilegeToken
  PID:4804
- C:\Windows\system32\reg.exe
  REG SAVE HKLM\SECURITY "registry\SECURITY" /Y
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3192
- C:\Windows\system32\reg.exe
  REG SAVE HKLM\SOFTWARE "registry\SOFTWARE" /Y
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4556
- C:\Windows\system32\reg.exe
  REG SAVE HKLM\HARDWARE "registry\HARDWARE" /Y
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:712
- C:\Windows\system32\reg.exe
  REG SAVE HKLM\SAM "registry\SAM" /Y
  2⤵
  - OS Credential Dumping: Security Account Manager
  - Suspicious use of AdjustPrivilegeToken
  PID:2084
- C:\Windows\system32\reg.exe
  REG UNLOAD HKLM\SogenSeed
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4736
- C:\Windows\system32\reg.exe
  REG LOAD HKLM\SogenSeed "registry\NTUSER.DAT"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4744
- C:\Windows\system32\reg.exe
  REG ADD HKLM\SogenSeed\Software\Valve\Steam\ActiveProcess /v SteamClientDll64 /t REG_SZ /d "C:\steam\steamclient64.dll" /f
  2⤵
  - Modifies registry key
  PID:2108
- C:\Windows\system32\reg.exe
  REG ADD HKLM\SogenSeed\Software\Valve\Steam\ActiveProcess /v SteamClientDll /t REG_SZ /d "C:\steam\steamclient.dll" /f
  2⤵
  - Modifies registry key
  PID:2252
- C:\Windows\system32\reg.exe
  REG ADD HKLM\SogenSeed\Software\Valve\Steam\ActiveProcess /v Universe /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:5128
- C:\Windows\system32\reg.exe
  REG ADD HKLM\SogenSeed\Software\Valve\Steam\ActiveProcess /v pid /t REG_DWORD /d 0x8B0 /f
  2⤵
  - Modifies registry key
  PID:4216
- C:\Windows\system32\reg.exe
  REG ADD HKLM\SogenSeed\Software\Valve\Steam\ActiveProcess /v ActiveUser /t REG_DWORD /d 100691295 /f
  2⤵
  - Modifies registry key
  PID:2736
- C:\Windows\system32\reg.exe
  REG ADD HKLM\SogenSeed\Software\Valve\Steam /v SteamPath /t REG_SZ /d "C:\steam" /f
  2⤵
  - Modifies registry key
  PID:4836
- C:\Windows\system32\reg.exe
  REG ADD HKLM\SogenSeed\Software\Valve\Steam /v SteamExe /t REG_SZ /d "C:\steam\steam.exe" /f
  2⤵
  - Modifies registry key
  PID:1712
- C:\Windows\system32\reg.exe
  REG UNLOAD HKLM\SogenSeed
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- C:\Windows\system32\reg.exe
  REG UNLOAD HKLM\SogenSwSeed
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2436
- C:\Windows\system32\reg.exe
  REG LOAD HKLM\SogenSwSeed "registry\SOFTWARE"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\seed-audio-endpoint.ps1" -Hive SogenSwSeed
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3860
- C:\Windows\system32\reg.exe
  REG UNLOAD HKLM\SogenSwSeed
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

OS Credential Dumping

T1003

Security Account Manager

T1003.002

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3860-2-0x000001E569170000-0x000001E569192000-memory.dmp

Download