6274e4a116698bf38df3ca9de0826d5eeb05dcbfbe8b3f903ab0f7b7d13fcc9c

Analysis

user interaction
yes
max time kernel
48s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nisalaluminyum_Year-End_Bonus_Form_2025_88983
Size 970B
Sample260812-xefzyssgrc
SHA256 6274e4a116698bf38df3ca9de0826d5eeb05dcbfbe8b3f903ab0f7b7d13fcc9c
MD5 ef895ec7c5597836e571bd52668a3438
SHA1 8eb0bf06af38e787660bde40d92c93633d184ae0
SHA512 5052b5fa9246c41dbd6359d28a8a2db4c0be5d660bf666583512912d777a2f194a035ebac0da8d4c6603a192b718048a836891d729f3b936b2c7163d38edf3ee
TLSH
T1481114028340311FA45B9060E561DBA4A6509E12625A1DF9E695D1BFF28D4E095753DC
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1688	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\nisalaluminyum_Year-End_Bonus_Form_2025_88983
1⤵
- Executes a command shell one-liner
PID:1688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads