2ac5c8d6d3b163a78a231537e86cd4e8f2e85aa6fac6fbc077f544fc4f62b3db

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/11/2026, 06:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x.bat
Size 318B
Sample261114-hmk7badz21
SHA256 2ac5c8d6d3b163a78a231537e86cd4e8f2e85aa6fac6fbc077f544fc4f62b3db
MD5 7c8bb921981915a4b7513499c7fdf015
SHA1 ea3a7ea8abbbf181dc31d6556aad8087d2437f32
SHA512 ecb8bf09efa00d8fe493c1bb720f99480af6dbe49e5de31a986e9991dd7785699e822768bc3923b8fb418323d6a767e47d476331e69600c6ca0160f6b7bb56ed
TLSH
T1B0E0BFD07BBE8946D2346C50199F1B292B44A2AB3625BA22C6D62530FC25553671C2D4
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution persistence

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1672	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 4020	1672	cmd.exe	91
PID 1672 wrote to memory of 6136	1672	cmd.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\x.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\schtasks.exe
  schtasks /query /tn Microsoft\Windows\WindowsCache /fo LIST
  2⤵
  PID:4020
- C:\Windows\system32\schtasks.exe
  schtasks /run /tn Microsoft\Windows\WindowsCache
  2⤵
  PID:6136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads