42c5d622b03fc36851dc86775f80164211de3208842990f73b21fa8b4fb65070

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42c5d622b03fc36851dc86775f80164211de3208842990f73b21fa8b4fb65070.exe
Size 68KB
Sample260719-3fc8caaw2t
SHA256 42c5d622b03fc36851dc86775f80164211de3208842990f73b21fa8b4fb65070
MD5 443012d8bb269397256dc84f3b301d0f
SHA1 2e383032d09343f443beb1e0e6aa98aade33a1f7
SHA512 3c0a5efe4983a4346be745a564936634f749b4d7f761b5059e6bc584f97ec1a0af315e1d1b9dd068cfab226d797307a76b49527bda557ac369de385aac0187ae
SSDEEP 768:Jzkp/T58qBT0b8w9ibVag76jQ02cO2DLBjCYZlChvUqiL33u6fx9I+iJ+LOWiJ+Y:pQ9eb5EVX0LBjPSOFRiYiPczg
TLSH
T1DF63E61DBB9374B8C216C13CAEFE4731B730BA2211316B2E4351EAB51E26B511E3E9D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5052	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 5052	2820	42c5d622b03fc36851dc86775f80164211de3208842990f73b21fa8b4fb65070.exe	89

C:\Users\Admin\AppData\Local\Temp\42c5d622b03fc36851dc86775f80164211de3208842990f73b21fa8b4fb65070.exe
"C:\Users\Admin\AppData\Local\Temp\42c5d622b03fc36851dc86775f80164211de3208842990f73b21fa8b4fb65070.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uninsep.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uninsep.bat

Path C:\Users\Admin\AppData\Local\Temp\_uninsep.bat
Size 298B
SHA256 2be4650af6a5eac722b11a90883ec87ba4a3af1ab5d047fa188ea97b37a1d94f
MD5 a8b78f3f58ace88f1b2aed4ca7f8f44a
SHA1 a5998c5e6ca5fdc1bb5de7ea64bda7991ae91a58
SHA512 ca3fb63b967b6d7302e23395ced56d301dc5ea20ec235f981d8b5ed61141e16b8f47fa48674b94bee7bada95c94ee276d7ce3e5a57f437532d5552861793dbe8
TLSH
T1ECE0C22682C7CAAB9048902759F1810AC0614ACA3E83372A9776C8D9508742EF8FBA41
MD5 SHA1 SHA512 TLSH