97b2a194946bb34af56102c5ee0c8fd7cec636935f3451afe3d7d8af31ed4197

Resubmissions

18/07/2026, 05:31

260718-f7z5vsht6r8

18/07/2026, 05:09

260718-ftft3acv4w3

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Common/res/TitleUpdate/GameRules/BuildOnly/BuildAll.cmd
Size 257B
Sample260718-ftft3acv4w
SHA256 97b2a194946bb34af56102c5ee0c8fd7cec636935f3451afe3d7d8af31ed4197
MD5 23a5f3906e3ee8322199a0f26e7c3bde
SHA1 0afcef4e2c0c0ef728bdb34496d29e403af095a3
SHA512 905f76ec2a76deaf9421cdb3f3691bedf3e92f516c3cc4e9b08257cb196fcc32009e5ca898b3f9e70a16228e07d63ed8acfb99bc0eeaf66ebf5e1c3b2fd49951
TLSH
T1A0D0CB3FB0294926782027EAD16552C1C401D4BD2614D9C59E5C444DBBBEF9E0636907
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4720	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Common\res\TitleUpdate\GameRules\BuildOnly\BuildAll.cmd"
1⤵
- Executes a command shell one-liner
PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads