2ce338133d21a07c521f10a317fbab0dbb14e9387b26036d76dc079ce53881c1

Analysis

user interaction
yes
max time kernel
41s
max time network
25s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cursor/install.cmd
Size 6KB
Sample260818-rbfbcscj6s
SHA256 2ce338133d21a07c521f10a317fbab0dbb14e9387b26036d76dc079ce53881c1
MD5 de63017c066ae859985725be45a11403
SHA1 3bef046ecef0fb7cd8f5fdf2600eea8927146856
SHA512 8c2049424ad3f026e1d7555ef56ac38dfe7d5f7765bc510eed2896843edb773c32b160393d968fe21c799a2b2fbcb07651a16420d881aee2559740c22f1706ae
SSDEEP 96:27/dR2dzy20BScxW8A716H07IE07pX07vB/vSPNdNQqrffzPgJPxC+Lk:27/dRygAcZU7I/7pE79vSP9ff0TLk
TLSH
T114D13F0E7E4D5536A735DA66AB61096FF70DF0CA0BBC89483023C049136D3D796ED27A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3480	powershell.exe
1096	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6076	cmd.exe
240	cmd.exe
2844	cmd.exe

Modifies Control Panel 6 IoCs

defense_evasion

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Desktop\UserPreferencesMask = 9e1e078012000000	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Cursors	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Cursors\ = "Cursor Concept Material Design HDPi Mint"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Cursors\Scheme Source = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Cursors\Schemes	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Cursors\Schemes\Cursor Concept Material Design HDPi Mint = "C:\\Users\\Admin\\AppData\\Local\\Cursors\\JepriCreations\\Cursor Concept Material Design HDPi Mint\\arrow.cur,C:\\Users\\Admin\\AppData\\Local\\Cursors\\JepriCreations\\Cursor Concept Material Design HDPi Mint\\help.cur,C:\\Users\\Admin\\AppData\\Local\\Cursors\\JepriCreations\\Cursor Concept Material Design HDPi Mint\\appstarting.ani,C:\\Users\\Admin\\AppData\\Local\\Cursors\\JepriCreations\\Cursor Concept Material Design HDPi Mint\\wait.ani,C:\\Users\\Admin\\AppData\\Local\\Cursors\\JepriCreations\\Cursor Concept Material Design HDPi Mint\\crosshair.cur,C:\\Users\\Admin\\AppData\\Local\\Cursors\\JepriCreations\\Cursor Concept Material Design HDPi Mint\\ibeam.cur,C:\\Users\\Admin\\AppData\\Local\\Cursors\\JepriCreations\\Cursor Concept Material Design HDPi Mint\\nwpen.cur,C:\\Users\\Admin\\AppData\\Local\\Cursors\\JepriCreations\\Cursor Concept Material Design HDPi Mint\\no.cur,C:\\Users\\Admin\\AppData\\Local\\Cursors\\JepriCreations\\Cursor Concept Material Design HDPi Mint\\sizens.cur,C:\\Users\\Admin\\AppData\\Local\\Cursors\\JepriCreations\\Cursor Concept Material Design HDPi Mint\\sizewe.cur,C:\\Users\\Admin\\AppData\\Local\\Cursors\\JepriCreations\\Cursor Concept Material Design HDPi Mint\\sizenwse.cur,C:\\Users\\Admin\\AppData\\Local\\Cursors\\JepriCreations\\Cursor Concept Material Design HDPi Mint\\sizenesw.cur,C:\\Users\\Admin\\AppData\\Local\\Cursors\\JepriCreations\\Cursor Concept Material Design HDPi Mint\\sizeall.cur,C:\\Users\\Admin\\AppData\\Local\\Cursors\\JepriCreations\\Cursor Concept Material Design HDPi Mint\\uparrow.cur,C:\\Users\\Admin\\AppData\\Local\\Cursors\\JepriCreations\\Cursor Concept Material Design HDPi Mint\\hand.cur,C:\\Users\\Admin\\AppData\\Local\\Cursors\\JepriCreations\\Cursor Concept Material Design HDPi Mint\\pin.cur,C:\\Users\\Admin\\AppData\\Local\\Cursors\\JepriCreations\\Cursor Concept Material Design HDPi Mint\\person.cur"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1096	powershell.exe
1096	powershell.exe
3480	powershell.exe
3480	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeDebugPrivilege	3480	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 240	6076	cmd.exe	89
PID 240 wrote to memory of 1096	240	cmd.exe	90
PID 6076 wrote to memory of 2844	6076	cmd.exe	91
PID 2844 wrote to memory of 3480	2844	cmd.exe	92
PID 6076 wrote to memory of 5628	6076	cmd.exe	93
PID 6076 wrote to memory of 3084	6076	cmd.exe	94
PID 6076 wrote to memory of 3012	6076	cmd.exe	95
PID 6076 wrote to memory of 5736	6076	cmd.exe	96
PID 6076 wrote to memory of 3436	6076	cmd.exe	97
PID 6076 wrote to memory of 4064	6076	cmd.exe	98
PID 6076 wrote to memory of 4920	6076	cmd.exe	99
PID 6076 wrote to memory of 2532	6076	cmd.exe	100
PID 6076 wrote to memory of 4464	6076	cmd.exe	101
PID 6076 wrote to memory of 6068	6076	cmd.exe	102
PID 6076 wrote to memory of 3132	6076	cmd.exe	103
PID 6076 wrote to memory of 5848	6076	cmd.exe	104
PID 6076 wrote to memory of 4472	6076	cmd.exe	105
PID 6076 wrote to memory of 5844	6076	cmd.exe	106
PID 6076 wrote to memory of 3892	6076	cmd.exe	107
PID 6076 wrote to memory of 1328	6076	cmd.exe	108
PID 6076 wrote to memory of 1284	6076	cmd.exe	109
PID 6076 wrote to memory of 3984	6076	cmd.exe	110
PID 6076 wrote to memory of 1456	6076	cmd.exe	111
PID 6076 wrote to memory of 4692	6076	cmd.exe	112
PID 6076 wrote to memory of 5412	6076	cmd.exe	114

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cursor\install.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "$t=\"mint\".Replace('-', ' ').Replace('_',' ');(Get-Culture).TextInfo.ToTitleCase($t)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$t=\"mint\".Replace('-', ' ').Replace('_',' ');(Get-Culture).TextInfo.ToTitleCase($t)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "$v=\"\".Replace('-', ' ').Replace('_',' ');(Get-Culture).TextInfo.ToTitleCase($v)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$v=\"\".Replace('-', ' ').Replace('_',' ');(Get-Culture).TextInfo.ToTitleCase($v)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3480
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors\Schemes" /v "Cursor Concept Material Design HDPi Mint" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\arrow.cur,C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\help.cur,C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\appstarting.ani,C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\wait.ani,C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\crosshair.cur,C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\ibeam.cur,C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\nwpen.cur,C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\no.cur,C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\sizens.cur,C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\sizewe.cur,C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\sizenwse.cur,C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\sizenesw.cur,C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\sizeall.cur,C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\uparrow.cur,C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\hand.cur,C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\person.cur,C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\pin.cur" /f
  2⤵
  PID:5628
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "Arrow" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\arrow.cur" /f
  2⤵
  PID:3084
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "Help" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\help.cur" /f
  2⤵
  PID:3012
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "AppStarting" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\appstarting.ani" /f
  2⤵
  PID:5736
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "Wait" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\wait.ani" /f
  2⤵
  PID:3436
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "Crosshair" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\crosshair.cur" /f
  2⤵
  PID:4064
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "IBeam" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\ibeam.cur" /f
  2⤵
  PID:4920
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "NWPen" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\nwpen.cur" /f
  2⤵
  PID:2532
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "No" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\no.cur" /f
  2⤵
  PID:4464
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "SizeNS" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\sizens.cur" /f
  2⤵
  PID:6068
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "SizeWE" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\sizewe.cur" /f
  2⤵
  PID:3132
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "SizeNWSE" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\sizenwse.cur" /f
  2⤵
  PID:5848
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "SizeNESW" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\sizenesw.cur" /f
  2⤵
  PID:4472
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "SizeAll" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\sizeall.cur" /f
  2⤵
  PID:5844
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "UpArrow" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\uparrow.cur" /f
  2⤵
  PID:3892
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "Hand" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\hand.cur" /f
  2⤵
  PID:1328
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "Person" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\person.cur" /f
  2⤵
  PID:1284
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "Pin" /t REG_EXPAND_SZ /d "C:\Users\Admin\AppData\Local\Cursors\JepriCreations\Cursor Concept Material Design HDPi Mint\pin.cur" /f
  2⤵
  PID:3984
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /ve /t REG_SZ /d "Cursor Concept Material Design HDPi Mint" /f
  2⤵
  PID:1456
- C:\Windows\system32\reg.exe
  reg add "HKCU\Control Panel\Cursors" /v "Scheme Source" /t REG_DWORD /d 1 /f
  2⤵
  PID:4692
- C:\Windows\system32\rundll32.exe
  rundll32.exe shell32.dll,Control_RunDLL main.cpl,,1
  2⤵
  - Modifies Control Panel
  PID:5412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e5bde5c6f1a3de113de3e621ea69873adb65c1085dddef53a6d7053e8147df74
MD5 9be6ba7307d95da301fb2bff952fe43c
SHA1 e70058b7aa7bf2326a5c2e92f32b31612d123660
SHA512 fe23e21ae3be59fef52a2d4bc18f7ac5a125e633da42e660b1a450274efab6582404adfa7cc7794bebbc2047b0171bc74dfae4b6ffa564d5459798da56fcc0bd
TLSH
T182115733B3CC8724CC9A413650CEAC1536B587DB409ECE6BBB84D548B82F199DFA1260
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1096-12-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/1096-4-0x0000021F69000000-0x0000021F69022000-memory.dmp

Download

memory/1096-5-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/1096-6-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/1096-7-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/1096-8-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/1096-9-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/1096-10-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/1096-0-0x00007FFDBCE5F000-0x00007FFDBCE60000-memory.dmp

Download

memory/1096-11-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/1096-1-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/1096-15-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/1096-14-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3480-16-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3480-20-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3480-21-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3480-22-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3480-23-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3480-26-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download

memory/3480-25-0x00007FFDBCCD0000-0x00007FFDBD674000-memory.dmp

Download