Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 11:30
Static task
static1
Behavioral task
behavioral1
Sample
Cleaner.cmd
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Cleaner.cmd
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target Cleaner.cmd
- Size 17KB
- Sample260720-nmacpsgv4k
- SHA256 99f93fc732c0c19c3a16fb53bf90c1ce151b9e4ddc2d72b68485242ced454f6c
- MD5 f8f24738081089238ae1840a410b2576
- SHA1 d73bc8af4437d8100f0fbc05eff2167c0ae7660b
- SHA512 e5af94bad6bde55803de72962c3faa8f6bc73634e1012b3a8b83d6f6b68549f180951bce8c22b1604e50867e1dd539d611f0ed5d1f2184f63d1e0c86cc891a1c
- SSDEEP 96:ID8nj4jbWD6xqh/cHhH6tMVISGRBH8gMlj3pDJW9GcjH+H/7XePRGCYX8R1ljXgQ:Ss3xbcuI3lV73EEaYfnDFNNxPi/
- TLSH T1FF826CA1F51AFB31F813201CE7AED88F54A5900531F477053BA1874CDAE296E9AB64F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\INF\microsoft_bluetooth_hfp_ag.inf cmd.exe File opened for modification C:\Windows\INF\sensorshidclassdriver.inf cmd.exe File opened for modification C:\Windows\INF\SERVIC~1.0\0C0A\_ServiceModelEndpointPerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\c_netservice.inf cmd.exe File opened for modification C:\Windows\INF\iscsi.inf cmd.exe File opened for modification C:\Windows\INF\mdmomrn3.inf cmd.exe File opened for modification C:\Windows\INF\MSDTCB~1.0\0407\_TransactionBridgePerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\wgencounter.inf cmd.exe File opened for modification C:\Windows\INF\.NET Data Provider for Oracle\_DataOracleClientPerfCounters_shared12_neutral.h cmd.exe File opened for modification C:\Windows\INF\bthspp.inf cmd.exe File opened for modification C:\Windows\INF\buttonconverter.inf cmd.exe File opened for modification C:\Windows\INF\c_fscopyprotection.inf cmd.exe File opened for modification C:\Windows\INF\SMSvcHost 4.0.0.0\040C\_SMSvcHostPerfCounters_d.ini cmd.exe File opened for modification C:\Windows\INF\c_dot4.inf cmd.exe File opened for modification C:\Windows\INF\c_sensor.inf cmd.exe File opened for modification C:\Windows\INF\.NET CLR Networking 4.0.0.0\0000\_Networkingperfcounters_d.ini cmd.exe File opened for modification C:\Windows\INF\.NET CLR Networking 4.0.0.0\0411\_Networkingperfcounters_d.ini cmd.exe File opened for modification C:\Windows\INF\halextpl080.inf cmd.exe File opened for modification C:\Windows\INF\mdmagm64.inf cmd.exe File opened for modification C:\Windows\INF\mdmgl006.inf cmd.exe File opened for modification C:\Windows\INF\microsoft_bluetooth_hfp.inf cmd.exe File opened for modification C:\Windows\INF\netmscli.inf cmd.exe File opened for modification C:\Windows\INF\SMSVCH~1.0\040C\_SMSvcHostPerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\SMSVCH~1.0\0411\_SMSvcHostPerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\c_computer.inf cmd.exe File opened for modification C:\Windows\INF\hvservice.inf cmd.exe File opened for modification C:\Windows\INF\mdmgsm.inf cmd.exe File opened for modification C:\Windows\INF\mdmiodat.inf cmd.exe File opened for modification C:\Windows\INF\netl160a.inf cmd.exe File opened for modification C:\Windows\INF\netwtw02.inf cmd.exe File opened for modification C:\Windows\INF\TermService\0411\tslabels.ini cmd.exe File opened for modification C:\Windows\INF\netrtwlans.inf cmd.exe File opened for modification C:\Windows\INF\prnms013.inf cmd.exe File opened for modification C:\Windows\INF\ramdisk.inf cmd.exe File opened for modification C:\Windows\INF\mchgr.inf cmd.exe File opened for modification C:\Windows\INF\mdmzyp.inf cmd.exe File opened for modification C:\Windows\INF\net1ic64.inf cmd.exe File opened for modification C:\Windows\INF\percsas3i.inf cmd.exe File opened for modification C:\Windows\INF\SERVIC~1.0\0411\_ServiceModelEndpointPerfCounters_D.ini cmd.exe File opened for modification C:\Windows\INF\.NET CLR Data\0411\_DataPerfCounters_d.ini cmd.exe File opened for modification C:\Windows\INF\61883.inf cmd.exe File opened for modification C:\Windows\INF\netwtw10.inf cmd.exe File opened for modification C:\Windows\INF\smartsamd.inf cmd.exe File opened for modification C:\Windows\INF\storfwupdate.inf cmd.exe File opened for modification C:\Windows\INF\hidlamparray.inf cmd.exe File opened for modification C:\Windows\INF\mdm5674a.inf cmd.exe File opened for modification C:\Windows\INF\.NET Data Provider for Oracle\_DataOracleClientPerfCounters_shared12_neutral.ini cmd.exe File opened for modification C:\Windows\INF\iagpio.inf cmd.exe File opened for modification C:\Windows\INF\mrvlpcie8897.inf cmd.exe File opened for modification C:\Windows\INF\urssynopsys.inf cmd.exe File opened for modification C:\Windows\INF\mdmgl009.inf cmd.exe File opened for modification C:\Windows\INF\netimm.inf cmd.exe File opened for modification C:\Windows\INF\pluton-heci.inf cmd.exe File opened for modification C:\Windows\INF\wvmic_shutdown.inf cmd.exe File opened for modification C:\Windows\INF\c_net.inf cmd.exe File opened for modification C:\Windows\INF\genericusbfn.inf cmd.exe File opened for modification C:\Windows\INF\mdmarch.inf cmd.exe File opened for modification C:\Windows\INF\mtconfig.inf cmd.exe File opened for modification C:\Windows\INF\netcxrd.inf cmd.exe File opened for modification C:\Windows\INF\netnb.inf cmd.exe File opened for modification C:\Windows\INF\netvwififlt.inf cmd.exe File opened for modification C:\Windows\INF\UGTHRSVC\0411\gthrctr.ini cmd.exe File opened for modification C:\Windows\INF\c_netdriver.inf cmd.exe File opened for modification C:\Windows\INF\mdmnttd2.inf cmd.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5908 cmd.exe