5efc91d91f1c1bbed0b0145de6755703dff5c30846bc45bbe00d97b6fcdcadd6

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 07:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AC/ACmenu.bat
Size 464B
Sample260728-jnvb2sstft
SHA256 5efc91d91f1c1bbed0b0145de6755703dff5c30846bc45bbe00d97b6fcdcadd6
MD5 ba3d15111af6ce05ea1d81dae1775d4d
SHA1 afba742784cab62083eff60a7453b9dc49cc41cd
SHA512 31ab3ad66b59f6948439914d7b2e54f027fa603a12c24d76e7d6434bf6112c3530d2e1719ac3eb3ac71ecbf3b0e5e6279b70d5d1729dc0d1850d4a56a4823518
TLSH
T1CAF0DCAC680A2230E176204176492BC2786E464F100E8C2CB4BAE01CCA7A3C858FD8CB
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4280	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 1780	4280	cmd.exe	90
PID 1780 wrote to memory of 3608	1780	csc.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\AC\ACmenu.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /nologo /target:exe /out:"ACmenu.exe" ACmenu.cs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3917.tmp" "c:\Users\Admin\AppData\Local\Temp\AC\CSC53AEC139921340C19773D835FCD7A184.TMP"
    3⤵
    PID:3608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3917.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3917.tmp
Size 1KB
SHA256 10c67c4418ad69686e669a2a5b0808185403b9f404fb416c2ad6988b3f8323db
MD5 b168e7f8c35ef6256dadfbb6b0f88847
SHA1 2eeb56d14c2d5ce14a0f9969110207058c5ac6ea
SHA512 045eb74e9255c05f0827c3ab0f8be6291d0889baa2756f3bf0eaea9ef60411a77be06fa4e708e84fffd569020d9a6670232b606daa137b412d188ef0fcc226e1
TLSH
T17341534193DC4B1FE272437129F75719E678FE599EAA535E7888122E1E02740DEC32B1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC53AEC139921340C19773D835FCD7A184.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\AC\CSC53AEC139921340C19773D835FCD7A184.TMP
Size 1KB
SHA256 3e2fbe9d82b4453e2e724e2a323c15bd21844c8b4f4a85e38943fd9c142b0058
MD5 c60c94b0e7f8f30a9ed64c0029f2a58f
SHA1 786878199bf1f289c5fa6fd370b8a72a84231530
SHA512 cf9e1c09a15f78f32a120e468d1dfe91596d550fa90f053a967ffe2cf17e6ae88754df650a037df252d6c3a2bc37ef2c702be2cdc1688f6e5a8c6fa242615eb8
TLSH
T18421AB81A3EC421EF2B347707AF2C362E16DBE668D7A43EC3898175F1F1690085836B1
MD5 SHA1 SHA512 TLSH