3b22e0e40fde7f3c10299aa0c2a27b8c85425138c46e0c6228e7262d1a0cc4af

Analysis

user interaction
yes
max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/07/2026, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
=?iso-8859-1?Q?SOA-T-n=B00792026=5Flinksnurserybalmedie.xls?=
Size 173KB
Sample260723-rhryqsbd44
SHA256 3b22e0e40fde7f3c10299aa0c2a27b8c85425138c46e0c6228e7262d1a0cc4af
MD5 739fab4f885f31074e8a535b712aa7da
SHA1 2d1fb3d4cb41649ccd8c5d19716ca89a0dabd1a5
SHA512 c19133a4befa4c07aeced0a5490b1b964da3acc4235a9522cf0de0908103fd566bfd9d255090c50aeaf5662a864ecbd944746233d9a22544d24582569cd65635
SSDEEP 3072:8SFsv66g3KnF439NKCdcIwqf7hpogPEWyU0gq3vBvE2Hs6Q4fpfh5qVKdgr+3g0c:8SFsv66g3KnF439NKCdcIw+7XogEU0gN
TLSH
T17E04E096BBE5C95CDC5617360AA08B726267FC811ED6D20BB208F71C1EF0EE24D416E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
840	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\=_iso-8859-1_Q_SOA-T-n=B00792026=5Flinksnurserybalmedie.xls_=
1⤵
- Executes a command shell one-liner
PID:840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads