35f8d38d0e96ee078c9ed375c9ce64c84641e7adc6d3970028f53ce7502dbd57

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bootstrap.cmd
Size 8KB
Sample260804-wxbbravsdw
SHA256 35f8d38d0e96ee078c9ed375c9ce64c84641e7adc6d3970028f53ce7502dbd57
MD5 ec60765041f39b8629bcb803693c2783
SHA1 e4ea25ed522adefbc0c4ad6dc0b1354ca045e4bb
SHA512 5a0f6b84282498d3cdf15cdbdf5e82bf46c5583f342ac8da8fd70b3663a895cdff84e0eb6ea0347a01074b99821cd4d8d57e139e196e151b73dae9aae32092f7
SSDEEP 192:gSaqu477XOmrt7XVd55vWHrnzttsX1tWExgwX/BQWNrIaFbLm:gSduE7XOmrrd55vornzfsX1tWExg8VN2
TLSH
T14202A50712C507AD107106713A601483E34B825F1B26575D39ECA7187FBABA25EFF3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4836	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4608	4836	cmd.exe	87
PID 4836 wrote to memory of 5480	4836	cmd.exe	88
PID 4836 wrote to memory of 4444	4836	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bootstrap.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\system32\curl.exe
  curl --version
  2⤵
  PID:4608
- C:\Windows\system32\curl.exe
  curl -fsSL "https://downloads.claude.ai/claude-code-releases/latest" -o "C:\Users\Admin\.claude\downloads\latest"
  2⤵
  PID:5480
- C:\Windows\system32\findstr.exe
  findstr /i /c:"0x80092012" /c:"0x80092013" "C:\Users\Admin\.claude\downloads\latest.stderr"
  2⤵
  PID:4444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

latest.stderr

Path C:\Users\Admin\.claude\downloads\latest.stderr
Size 72B
SHA256 8f83a3221b5eaca60c02ead9f67a411f64a34b275cd4ee9613a4411be23063dc
MD5 54b18c4aa4e5d221b8229383dc31bf1f
SHA1 015eaad3285b3bb7d72f8bf9a779a272c9e38c48
SHA512 20ba505b9af2bb5aac2c8e6c18fd35a7fe2d912a545bfd742871ecd70e37e00f18eaa845a5800c47664b85a786b71d65e5bac251aa8b7e7f668da6961b9209a7
TLSH
T1F1A0223E080002A00330A000200302333F03032C0BC0A0220EA2830CE8A0C00C0E338B
MD5 SHA1 SHA512 TLSH

Submit Download