35f8d38d0e96ee078c9ed375c9ce64c84641e7adc6d3970028f53ce7502dbd57

Analysis

max time kernel
150s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bootstrap.cmd
Size 8KB
Sample260804-wxbbravsdw
SHA256 35f8d38d0e96ee078c9ed375c9ce64c84641e7adc6d3970028f53ce7502dbd57
MD5 ec60765041f39b8629bcb803693c2783
SHA1 e4ea25ed522adefbc0c4ad6dc0b1354ca045e4bb
SHA512 5a0f6b84282498d3cdf15cdbdf5e82bf46c5583f342ac8da8fd70b3663a895cdff84e0eb6ea0347a01074b99821cd4d8d57e139e196e151b73dae9aae32092f7
SSDEEP 192:gSaqu477XOmrt7XVd55vWHrnzttsX1tWExgwX/BQWNrIaFbLm:gSduE7XOmrrd55vornzfsX1tWExg8VN2
TLSH
T14202A50712C507AD107106713A601483E34B825F1B26575D39ECA7187FBABA25EFF3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5796	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5796 wrote to memory of 4548	5796	cmd.exe	90
PID 5796 wrote to memory of 2340	5796	cmd.exe	91
PID 5796 wrote to memory of 2956	5796	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bootstrap.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Windows\system32\curl.exe
  curl --version
  2⤵
  PID:4548
- C:\Windows\system32\curl.exe
  curl -fsSL "https://downloads.claude.ai/claude-code-releases/latest" -o "C:\Users\Admin\.claude\downloads\latest"
  2⤵
  PID:2340
- C:\Windows\system32\findstr.exe
  findstr /i /c:"0x80092012" /c:"0x80092013" "C:\Users\Admin\.claude\downloads\latest.stderr"
  2⤵
  PID:2956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

latest.stderr

Path C:\Users\Admin\.claude\downloads\latest.stderr
Size 105B
SHA256 0f4ed14ffca9bc25f62ffa17a2182efba96e539c91d81b25f543d210ed10b445
MD5 ef1fa580581249c1513ab83233efa9e9
SHA1 c270f9c7e97380dd5a0b0b0557ad6513872e0194
SHA512 ad527ad4e83c3c21db8efcdc0da5ece550c339244700f0811579099c967178253e675b3f0349e63cd73d7371bf08e9a656ce3ac429dfbf3408c487b7d12542d6
TLSH
T135B0127F821102290332282890039533FB47215D1B4080140FD28A1DE5B2F94D4F63D7
MD5 SHA1 SHA512 TLSH

Submit Download