1151908318c98032ee007400158bad935be9e8d547523224f92c2b5a83b8f35b

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IP-Grabber-PoC-main/start.bat
Size 431B
Sample260722-e8jc3adk31
SHA256 1151908318c98032ee007400158bad935be9e8d547523224f92c2b5a83b8f35b
MD5 bb556f999dda5c4efdfa6b1734aa5c1b
SHA1 5d9a3395444e94abd7c3c3cca2eee7b5313b2382
SHA512 be1c8247ef12def4613c0634b0867077b49e82dce349f3ba3deebb74ef451badad095f4bb7842051fc390af2616dd7b299bf3457531785fd02e22e71eec45a60
TLSH
T1A9E02B8B748A553124D9D4B97C4731E6B906DC6F3523DC39F09F826E2F8A2C0C8E84D2
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1444	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\IP-Grabber-PoC-main\start.bat"
1⤵
- Executes a command shell one-liner
PID:1444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads