276820849402e38c4c43d7c208f776648a7385ed99145f467d40fae43ac91708

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/07/2026, 02:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TempSpoofer.exe
Size 1.5MB
Sample260727-c4n2msgj91
SHA256 276820849402e38c4c43d7c208f776648a7385ed99145f467d40fae43ac91708
MD5 712b56bd2eef24481a43ac3b17fc12d2
SHA1 2c3071064c87950bc301d475a17cc492969ee584
SHA512 4724ee1785b55e7118c5f4f8d63d4c5af56774bc5c2c60a844ecc6c5681712eefd0ae119b72b621c41b6f19a877e60102ea994802dfd557bd2a1f858290543c3
SSDEEP 24576:9NRtX1IGyVtGswprvyJK3he/zG4dtYnhfE7JHShZPExuNQ+zGJAeIEas053qYu58:Rr+7ZS
TLSH
T115758EEC449C46BCE316DA34A5866387B3F7BE8FA2E8EF7566E05C940C1F480F125499
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3208	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 3208	1220	TempSpoofer.exe	81

C:\Users\Admin\AppData\Local\Temp\TempSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\TempSpoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads