eb7f7e76f935aa9332dcc3ecdbe83acd336545227d4ebeef88b0935d0cadd99a

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
terraria_7.6/Home键在哪里/虚拟键盘.bat
Size 3B
Sample260714-d5ed9sdv7m
SHA256 eb7f7e76f935aa9332dcc3ecdbe83acd336545227d4ebeef88b0935d0cadd99a
MD5 7ff180711661c8e7f8941e72ca7ed522
SHA1 84f0476efdca0c1c948a668f44dc9cf739ba9f1a
SHA512 96acc2c9415750ff98c8405a1df27d9ac3049112cc2eaba2591a00a53f8bb600117f30d78d5613414dc56ea49b0046ef725adf361528f3e840ac5e4e4d2346b2
MD5 SHA1 SHA512

Score

3^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe
5904	osk.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 5904	3744	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\terraria_7.6\Home键在哪里\虚拟键盘.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\system32\osk.exe
  osk
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads