f76219aa95db55b27952f35e8466a52bcba995270fb03a8a3480e37a614c7ba8

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FactoryReset-GMod.bat
Size 2KB
Sample260730-d5nypscl3x
SHA256 f76219aa95db55b27952f35e8466a52bcba995270fb03a8a3480e37a614c7ba8
MD5 7482c0ff6b24ba4111733dfc7642e6c7
SHA1 891dd378d9018235df392393f6799051431f169f
SHA512 a2820616c3f09393316d36fdac7b0fe1e2d96803230564f701f04402ae10b2188e0b60d086f091e0f9ed0368f10562a6b00238ef3338de0c50930d3631d76ebf
TLSH
T18B41205E2D7BFC6E15F522B39F296481CA02506C7E224434389BC8C9BF6E2C953390EC
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5908	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FactoryReset-GMod.bat"
1⤵
- Executes a command shell one-liner
PID:5908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads