2ac5c8d6d3b163a78a231537e86cd4e8f2e85aa6fac6fbc077f544fc4f62b3db

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/11/2026, 06:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x.bat
Size 318B
Sample261114-hmk7badz21
SHA256 2ac5c8d6d3b163a78a231537e86cd4e8f2e85aa6fac6fbc077f544fc4f62b3db
MD5 7c8bb921981915a4b7513499c7fdf015
SHA1 ea3a7ea8abbbf181dc31d6556aad8087d2437f32
SHA512 ecb8bf09efa00d8fe493c1bb720f99480af6dbe49e5de31a986e9991dd7785699e822768bc3923b8fb418323d6a767e47d476331e69600c6ca0160f6b7bb56ed
TLSH
T1B0E0BFD07BBE8946D2346C50199F1B292B44A2AB3625BA22C6D62530FC25553671C2D4
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution persistence

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3668	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 3796	3668	cmd.exe	86
PID 3668 wrote to memory of 2524	3668	cmd.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\x.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\system32\schtasks.exe
  schtasks /query /tn Microsoft\Windows\WindowsCache /fo LIST
  2⤵
  PID:3796
- C:\Windows\system32\schtasks.exe
  schtasks /run /tn Microsoft\Windows\WindowsCache
  2⤵
  PID:2524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads