ba4bfd80f12090e90d2bd24e48a955cd27ed69bfef04768aac1733c0d762af69

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$1/MPS/unregproxysvc.bat
Size 52B
Sample260802-pm286asgre
SHA256 ba4bfd80f12090e90d2bd24e48a955cd27ed69bfef04768aac1733c0d762af69
MD5 5f297b588c92ebfba62c48bcb2b06118
SHA1 b12a8213cfebe7a710ee23854e34e087fecd68d8
SHA512 afa2e2fa7f4506966c7026ee586484ea6766f2a0af2583973159c8251d8336ea8b9d37b076fad86c26d487d20daa7d41e8f1a5b3c3ea1b703dd4a84e7b176879
TLSH
T13E900249CC96C58CC77D6412012827417241E60D04742541088422348870DC9A51D78E
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3648	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\$1\MPS\unregproxysvc.bat"
1⤵
- Executes a command shell one-liner
PID:3648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads