a051f189bbdb9c057e6f069441032cc251642ee4b02e9df20e19be2b537bbf4c

Analysis

max time kernel
60s
max time network
55s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Skaza.exe
Size 875KB
Sample260816-ef52cszves
SHA256 a051f189bbdb9c057e6f069441032cc251642ee4b02e9df20e19be2b537bbf4c
MD5 04ed23503fbdddfe4a790bdd4450314a
SHA1 b7208e7ca8a2f04836112516fcaeb9e70cea79b4
SHA512 42c2bb773c68de8d1ce0da2aa05c2daac091feb1c08a7e635c4686fd0ff8f812868f7ed05fb4ae65a37a42db5b7512a8204f3ec267dc96285b7d84cf40dc2c4a
SSDEEP 24576:bTFyJXXCmWl/Dob17Q8JNjlyoyGW+rQ9nJvxq:FsHCmpzPpd1rmnJI
TLSH
T11E159E5AA3E801FAD46B903C9557A707F6B2745A03109BCB13E089793F73BE05EBA711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3644	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3116	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3116	taskkill.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 3116	1384	Skaza.exe	90
PID 1384 wrote to memory of 3644	1384	Skaza.exe	91
PID 3644 wrote to memory of 4564	3644	cmd.exe	92
PID 3644 wrote to memory of 5456	3644	cmd.exe	93
PID 3644 wrote to memory of 1100	3644	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\Skaza.exe
"C:\Users\Admin\AppData\Local\Temp\Skaza.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /F /T /IM FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Skaza.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Skaza.exe" MD5
    3⤵
    PID:4564
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:5456
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:1100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads