208c092fe77f161c5a313b916d73fa7f6d10dd289bab8bb5dfb3d59aacb27f25

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
paid_clumsy/paid clumsy/Paid Clumsy/WinDivert64.sys
Size 37KB
Sample260811-vschksxdpc
SHA256 208c092fe77f161c5a313b916d73fa7f6d10dd289bab8bb5dfb3d59aacb27f25
MD5 3bd5ac2e9d96e680f5dbdd183a58c47d
SHA1 83b08cb5e61c7b37bd710ea01196a26fc8f38610
SHA512 6cccd7971f423f72f5dbd01a83a2d27bb2bde63c4d1f5e127d77cfa0df85c289a2c3cd95c110ce38b58b9ea9a49aad18ae50f352ac6b21740d0294f771fbcb78
SSDEEP 768:R5VorUqgJs3/KtdrbYiZdNSRUYjbMUYOUaCdHUZ9fdCrYc:vVorUn9cRUuILLd07fdCU
TLSH
T1B3033B22A3F01449F9E3CA7456F69362EB31FC826720D7CF039590494F66BE5167A32A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
736	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\paid_clumsy\paid clumsy\Paid Clumsy\WinDivert64.sys"
1⤵
- Executes a command shell one-liner
PID:736
- C:\Users\Admin\AppData\Local\Temp\paid_clumsy\paid clumsy\Paid Clumsy\WinDivert64.sys
  "C:\Users\Admin\AppData\Local\Temp\paid_clumsy\paid clumsy\Paid Clumsy\WinDivert64.sys"
  2⤵
  PID:4804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4804-0-0x0000000000010000-0x000000000001E000-memory.dmp

Download