5c3e7bbb06ebb134bed7b1231fdf3139a2052cbe5e8c8418e54237933b51bb4e

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x64/SigDivort64.sys
Size 88KB
Sample260810-wt691sen5t
SHA256 5c3e7bbb06ebb134bed7b1231fdf3139a2052cbe5e8c8418e54237933b51bb4e
MD5 ae66b5b024e79f8b158bbedecd75f71b
SHA1 72abf8ea3b82eff3c7da99500afc87670bef9c82
SHA512 cc3657299118b7bb6537bff4ec0389b97d6ef5b351db5fd023787a64ca6b98062c6fe06a9dff8aca82fd0cb4532d517509b2e36247fa0b9de3116203b2e3ab47
SSDEEP 1536:7ovgCRgYL/h//oJJw5AdPtey2AyWpdsimpxpWXixv6W:74jmJJsKle9A5pdsiypgovl
TLSH
T1DD935C46A2E201C5F9F6C97895B59253EF31FA91AB22C7DF11D0981E4F21BE0BD78321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4772	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\x64\SigDivort64.sys
1⤵
- Executes a command shell one-liner
PID:4772
- C:\Users\Admin\AppData\Local\Temp\x64\SigDivort64.sys
  C:\Users\Admin\AppData\Local\Temp\x64\SigDivort64.sys
  2⤵
  PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads