What a Beginner’s Malware Sample Actually Does to a Host
Most of what gets called “malware” isn’t clever. It’s a few lines doing something the operating system already permits, placed somewhere the system already checks on every boot. That’s the idea I want to get across, so I use the smallest example I can: a Windows batch script that shuts the machine down, set to run at startup.
On its own it’s harmless in a VM and useless to a real attacker. But it demonstrates two things cleanly — a disruption payload and a persistence mechanism — and once you understand why those two pieces matter, you’ve got most of what you need to start reading real samples.
⚠️ Lab only. Run this inside a virtual machine, never on a machine you care about.
Step 1: Create a snapshot of the Virtual Machine
Go to the Machine and click on “Take Snapshot”. The snapshot name can be random or specific.
I created a snapshot a few minutes ago, and it looks like this.
Step 2: Write a Basic Shutdown Script
Open Notepad and add the following line to the file.
@echo off
shutdown.exe /s /f /t 2
/t is for time (in seconds).
Save the file as shutdown.bat.
Test the script by double-clicking and see if it shuts down the windows.
Step 3: Achieve Persistence
We will achieve persistence by using the startup folder method. If we drag any file into this folder, then the file runs at startup.
Get Muhammad Bilal’s stories in your inbox
Join Medium for free to get updates from this writer.
Press Win + R, type shell:startup and press Enter.
Copy shutdown.bat into the folder.
Reboot the system (in VM) and observe behaviour. It will start and shutdown after a few seconds.
Step 4 (Optional): Monitor Registry Changes
This step is optional and especially for people learning malware analysis.
Take a Regshot before and after adding the file to the startup folder or Task Scheduler. To be clear, take the first snapshot, then copy the file, and only after that take the second snapshot. Do not restart the computer in between — otherwise, the malware will execute and shut down the system as expected (you know what I mean).
After you click on compare and see the output. You will find the shutdown.bat file somewhere.
Note: If you’re using this malware as a prank, make sure to set a sufficient delay in seconds. During that time, if you remove the .bat file from the startup folder, the malware will not execute again after removal.
Conclusion: We created a basic form of script-based malware that demonstrates Persistence mechanisms, the importance of monitoring startup entries, and why user education and system restrictions are critical to preventing even basic malware execution.
You can follow me or message me on LinkedIn for help. To show support, you can buy me a coffee: https://www.buymeacoffee.com/bilalyounis
