5e496781069a5bd99debc3ca07e0db03aaf7a377f6cc878fb06d4130d53acc09

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mpe.sys
Size 14KB
Sample260720-ebyfqagz81
SHA256 5e496781069a5bd99debc3ca07e0db03aaf7a377f6cc878fb06d4130d53acc09
MD5 83eff7b976ae24f1a496ca94a8a19919
SHA1 b15cea5264d59e659f1b39e7bd0d790a75458a41
SHA512 d8fe806cf026dfbfb2da2f41f78116755067ac0a7330e9367cf43ca383ea512247dc1ca49060889bd2e92e3309ea0e326e48f31de1595da50062568675650d9c
SSDEEP 384:IbqWaXa0dcTMWOsH380tdA+RbCWhlrwWv:IbqWaaqWOsH3ttdAuD
TLSH
T10E629448E79D45B3ED5AA5BCE3C30F94EDFB541542234BC98BA966042D117C3DC28BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4824	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\mpe.sys
1⤵
- Executes a command shell one-liner
PID:4824
- C:\Users\Admin\AppData\Local\Temp\mpe.sys
  C:\Users\Admin\AppData\Local\Temp\mpe.sys
  2⤵
  PID:3324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3324-0-0x0000000000010000-0x0000000000013B00-memory.dmp

Download