Analysis
- max time kernel
899s - max time network
616s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-es - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 08:59
Behavioral task
behavioral1
Sample
Sonic Mania.iso
Resource
win11ltsc2024-20260709-es
3 signatures
900 seconds
Behavioral task
behavioral2
Sample
out.iso
Resource
win11ltsc2024-20260709-es
1 signatures
900 seconds
Behavioral task
behavioral3
Sample
SonicMania-1.ico
Resource
win11ltsc2024-20260709-es
2 signatures
900 seconds
Behavioral task
behavioral4
Sample
autorun.inf
Resource
win11ltsc2024-20260710-es
1 signatures
900 seconds
Behavioral task
behavioral5
Sample
elamigos-1.bin
Resource
win11ltsc2024-20260709-es
4 signatures
900 seconds
Behavioral task
behavioral6
Sample
elamigos.jpg
Resource
win11ltsc2024-20260709-es
3 signatures
900 seconds
General
- Target out.iso
- Size 223.7MB
- Sample260808-kxpnlacm9t
- SHA256 ade5887048eca935100cd6f33bca4ede2e75d4b1abc1b12f743eb82076f8a7bf
- MD5 3006727cf36b7d2f6bc85a5601b8ff10
- SHA1 0b06a6c93c5f523342f2529016c6f5c5526ba194
- SHA512 f1cfaba89a2dff0222f3859f572a161e61e7d3ac888838982d1165176471a8db8b65f2c31669a20ec86ec7227833279a0901d9578f48d9d900dfe4006a127f29
- SSDEEP 6291456:shnQUcXJtDRIwAFeNnluZvR+RSKL53tZ7GDrX:CQUcXvRIwAgNluZZy/ZCDrX
- TLSH T1DFB8330560468F79C6F28B70891E5825A9CE5C442CAD676CFD3C7F9F332E5AB093B198
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 984 cmd.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\out.iso1⤵
- Executes a command shell one-liner
PID:984
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4172
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:4548