1eaa5a1cc5bee8d2b7358b2b079e212221803f838ea35e5c4fc66be468648bd8

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$1/MPS/unregredirsvc.bat
Size 56B
Sample260802-pm286asgre
SHA256 1eaa5a1cc5bee8d2b7358b2b079e212221803f838ea35e5c4fc66be468648bd8
MD5 b3365fb07057a0890b91061498671c5f
SHA1 2322b07bfae874c4b74021cee7a4a4bbc8bf7e4c
SHA512 e9f118e6031bf0bc92a1f7bb61fa405e9e297794d17d731925af0d030f908847291e2de92222ca0f0b1db0ae5622e513999b1029fc96076b6dc450a6983841a3
TLSH
T120900204C04666D666455916142376826193FF0D4030199A986D5B10C15074B992D54B
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4564	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\$1\MPS\unregredirsvc.bat"
1⤵
- Executes a command shell one-liner
PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads