beaa33ece9b501ff0052b2501b7a9145f62912f036b255bee3c9b98509b41be6

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vendor/bin/phpunit.bat
Size 117B
Sample260819-ph86xaar3w
SHA256 beaa33ece9b501ff0052b2501b7a9145f62912f036b255bee3c9b98509b41be6
MD5 04616de4cc31dbd8be8b5b752cdf219c
SHA1 a9ac8886049c68e452bfc65ddd5613093a4fc9d0
SHA512 f6231229de0ddd042d768903e8916ed735d7b74ee7e5df29a51f3afd8a7949be9eb00a266339b0c2aba285749dbea4449f92aae30c4cc2145550dd1102bf3dc1
TLSH
T1C0B092F8B277B6E76D601E2CCC4B444BA3A1A53F1F9A842BA224D554940C6862E8BC24
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2740	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\vendor\bin\phpunit.bat"
1⤵
- Executes a command shell one-liner
PID:2740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads