fe27ac5a7a72e2f380ecd90367eccec418f87dd7cabb3d3a19ba27f38871b13e

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.bat
Size 3KB
Sample260721-phrxmabl3x
SHA256 fe27ac5a7a72e2f380ecd90367eccec418f87dd7cabb3d3a19ba27f38871b13e
MD5 efc869e1d2ec0db71eb82e86bc114b7b
SHA1 066e0391da7faa969a7c506beff3beef74b9bd53
SHA512 edf588d20a0a66f510a370ec63fb351054b201c091d7c26f0501197741911184b7c7dd73b7d8ef3aa0bdf19e7901935066ffaa031a655b22f668f1ee5c12f1b1
TLSH
T14F610F808F522F751454CF59E07A82C3E733D006A7C67070189DBC9ABB8D7A63D3EAA4
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
872	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\setup.bat"
1⤵
- Executes a command shell one-liner
PID:872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads