a3045a4f29a8c86e6fe5af9e5c9225294d266c6218d65bbfcaa5a7d1c683abd7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 17:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
usb driver CH341/usb driver CH341/USB DRIVER1/CH341PAR/DRIVER/CH341WDM.sys
Size 19KB
Sample260804-wbtafaweqe
SHA256 a3045a4f29a8c86e6fe5af9e5c9225294d266c6218d65bbfcaa5a7d1c683abd7
MD5 e6e76d443e2925f7ae9d9fbf4255b50c
SHA1 7b015676e8c4e95bf82455b6e14ad3ee4748fdcc
SHA512 0d1640b77031749d9b520aa801d9734a7bd9c41176177754de23841a5e948899458fafff6cabefbb8c357e1435248b3afa1f08a35dc1f7c11e5bb832c832e2c4
SSDEEP 384:ssQeTJ1C/0kXll74neTi90iXE5JIfreHM3FJR3V7z:VQh0WLfuPXw6frL97z
TLSH
T1D8925E81E1878CF3DB4989B0155A77B7613F17222216A6BF83BCCDAC0B1F261BF25125
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1864	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\usb driver CH341\usb driver CH341\USB DRIVER1\CH341PAR\DRIVER\CH341WDM.sys"
1⤵
- Executes a command shell one-liner
PID:1864
- C:\Users\Admin\AppData\Local\Temp\usb driver CH341\usb driver CH341\USB DRIVER1\CH341PAR\DRIVER\CH341WDM.sys
  "C:\Users\Admin\AppData\Local\Temp\usb driver CH341\usb driver CH341\USB DRIVER1\CH341PAR\DRIVER\CH341WDM.sys"
  2⤵
  PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4352-0-0x0000000000010000-0x0000000000014CC0-memory.dmp

Download