c2f53f4e5636f1e742a601db006f735afdcc42d7c56b6a247094b4cd5e1a562b

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ccdecode.sys
Size 16KB
Sample260720-ebyfqagz81
SHA256 c2f53f4e5636f1e742a601db006f735afdcc42d7c56b6a247094b4cd5e1a562b
MD5 3ad2f721d02d28d8f8c42f3c1145824d
SHA1 c3e27ad216f9ec57b02614e7c1e1de9a189e0d7a
SHA512 efde7da34eb0db5892dd3c81511857873299e4df74802d28cd401d3793581b3fb8c7bffd349a01081ff30626df02abf87e122f30b997ee32eda108c57f8ede27
SSDEEP 384:/iFWZsvzcfhWGR6/xPoH6ZhhiW75Xyn2VvnEsg2WIIW:/c+sgDjW975XfJEpg
TLSH
T119721B84B3C04DB1ED471CB1446B770927B3EB121B2693EB9110EDAA7C2B2D0AD7D6D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4316	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ccdecode.sys
1⤵
- Executes a command shell one-liner
PID:4316
- C:\Users\Admin\AppData\Local\Temp\ccdecode.sys
  C:\Users\Admin\AppData\Local\Temp\ccdecode.sys
  2⤵
  PID:5096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5096-0-0x0000000000010000-0x0000000000014000-memory.dmp

Download