920630a1d1ec47aedea7345e3c868ecdc07e191373497bbf47fbbf5942fbad4f

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
node-v18.20.4-win-x64/corepack.cmd
Size 218B
Sample260805-rmqapstyfz
SHA256 920630a1d1ec47aedea7345e3c868ecdc07e191373497bbf47fbbf5942fbad4f
MD5 c046e14548ebb384ef71c0efea0e857a
SHA1 504e3d339b444b1051fb0b033da0f2e661385c0d
SHA512 efac98aadbdea59064d5752884bc9697c9fd15ad44e820f9457f679ad4e68be2e11e965af03ad70fee1f34c93c64eaf1813c60f19145ec1b693787a45c602833
TLSH
T12FD0127005BE4F333A5A2DF9F48213B778CDABA104150DBC7D29439202CC2C687D12D5
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2416	cmd.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3484	node.exe
3484	node.exe
3484	node.exe
3484	node.exe
3484	node.exe
3484	node.exe
3484	node.exe
3484	node.exe
3484	node.exe
3484	node.exe
3484	node.exe
3484	node.exe
3484	node.exe
3484	node.exe
3484	node.exe
3484	node.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 3484	2416	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\node-v18.20.4-win-x64\corepack.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\node-v18.20.4-win-x64\node.exe
  "C:\Users\Admin\AppData\Local\Temp\node-v18.20.4-win-x64\\node.exe" "C:\Users\Admin\AppData\Local\Temp\node-v18.20.4-win-x64\\node_modules\corepack\dist\corepack.js"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads