15b426e1c03c0976c9b133f82553da5c7e9cf3320dbb3b5cf269854afc80b548

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nssm-2.24-101-g897c7ad/src/version.cmd
Size 1KB
Sample260724-g14p5stdnb
SHA256 15b426e1c03c0976c9b133f82553da5c7e9cf3320dbb3b5cf269854afc80b548
MD5 3e67b67b2ecb2d3042dfaa7d216883b1
SHA1 1e857c1fac7a99a8d280e219e9a8f1bd4d315a5d
SHA512 6482ee84a35462f38468cf3d4e31841524d4ad4b1bae9ac24df6f24c74676a8fe8c3999461698ec4e29bcfc57c9e1348795454edc9d95380c020dfdd5ba71407
TLSH
T19031D98B1A87993358AB2237BC2842467770C1722317C89CB4272A8867874E9A3F17C9
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4928	cmd.exe
4948	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4948	4928	cmd.exe	86
PID 4928 wrote to memory of 4368	4928	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\nssm-2.24-101-g897c7ad\src\version.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c git describe --tags --long
  2⤵
  - Executes a command shell one-liner
  PID:4948
- C:\Windows\system32\fc.exe
  fc version.h version.h.new
  2⤵
  PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads