a283e7a9c86bbd9fd8e68c0652c7fa55de28257e6ed8fd0b17819b1935199aa7

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
149s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
spoofer 1.cmd
Size 1KB
Sample260723-19d1macm4s
SHA256 a283e7a9c86bbd9fd8e68c0652c7fa55de28257e6ed8fd0b17819b1935199aa7
MD5 4b216084102c23e4b7d47c80fddc69ec
SHA1 14e838c9d172fb00eff3c02781498e6a18122d31
SHA512 087e64b26f7f91fb8aa156e244aaa8504491034132a7d8bf47e22a02375fe7b87052ec0c440027ad5705b52c82e96d7ae1eb26d441196dc48ea1f44ade4511f4
TLSH
T168314502BBEFA061F9ED00BC00E77884EC467F7B195A7F8EB645D8C081BC4543668A25
MD5 SHA1 SHA512 TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2072	cscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5908	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1036	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5908	powershell.exe
5908	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5908	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5908	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 5908	1036	cmd.exe	90
PID 1036 wrote to memory of 2072	1036	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\spoofer 1.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "(New-Object -ComObject shell.application).ToggleDesktop()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5908
- C:\Windows\system32\cscript.exe
  cscript //nologo msg.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msg.vbs

Path C:\Users\Admin\AppData\Local\Temp\msg.vbs
Size 107B
SHA256 1f7e95b561d38516913c53deaa50eb337ed985c5d422e36b27f7f5e08ce84ffd
MD5 ccd2f23e0881c9038557896cb906596c
SHA1 31b9dbafbd46a619a95d70d371f6ce20316548af
SHA512 9ddf9592061f477e0055a75094433a30882376b53ba44c1ff4f1f20f395c9b8a2a86a3cfbf023a82a94d9a0157794404a163952704e779dccfca0e4a49ec871e
TLSH
T171B01232AC6CD805E68EC2E102E35304AB4C404000139C66DEA4C5C8134D0B0372513A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5908-0-0x00007FFF17CEF000-0x00007FFF17CF0000-memory.dmp

Download

memory/5908-3-0x000001C2F6A10000-0x000001C2F6A32000-memory.dmp

Download

memory/5908-4-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/5908-5-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/5908-6-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/5908-7-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/5908-8-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/5908-10-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download

memory/5908-11-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp

Download