Analysis
- user interaction
yes - max time kernel
141s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/11/2026, 04:46
Static task
static1
Behavioral task
behavioral1
Sample
hahahaha.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
hahahaha.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target hahahaha.bat
- Size 2KB
- Sample261106-feaphawydz
- SHA256 40df4000dbb276607af0f28b9a9a57510c242d8b7311bac81f93c38ee8038cd7
- MD5 64de141c900b9ba82f8d57cb0fef4e57
- SHA1 d0561800823c33552cd9c9191b34869d365611cc
- SHA512 0ffd1eb46792e48fb621388228619d501afc04d7ef01c36d6e042cfe176955877095f2df5eabf94a6eb94c597314b0e93e6f2fc0d658369be906529f2cfb8e0c
- TLSH T1BC51E05A366192A0906048821BDF5173FC91A59F9E40FD8422C7517CEB133A06BFBDDB
- MD5 SHA1 SHA512 TLSH
Score
8/10
Malware Config
Signatures
- Possible privilege escalation attempt 2 IoCs
pid Process 5332 takeown.exe 4540 icacls.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 5332 takeown.exe 4540 icacls.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4948 cmd.exe - Kills process with taskkill 3 IoCs
pid Process 1172 taskkill.exe 5712 taskkill.exe 5792 taskkill.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1172 taskkill.exe Token: SeDebugPrivilege 5712 taskkill.exe Token: SeDebugPrivilege 5792 taskkill.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe Token: SeTakeOwnershipPrivilege 5332 takeown.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4948 wrote to memory of 1172 4948 cmd.exe 92 PID 4948 wrote to memory of 5712 4948 cmd.exe 94 PID 4948 wrote to memory of 5792 4948 cmd.exe 95 PID 4948 wrote to memory of 5332 4948 cmd.exe 96
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hahahaha.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1172
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im OneDrive.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5712
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im Teams.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5792
-
-
C:\Windows\system32\takeown.exetakeown /f C:\*.* /r /d y2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:5332
-
-
C:\Windows\system32\icacls.exeicacls C:\*.* /grant administrators:F /t2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4540
-