88b787db1eb0e288244906d028449e4ac8b9031886c97bcab13d4b6a965f6b02

Analysis

max time kernel
148s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
seggs.exe
Size 1024KB
Sample260820-2hba4agb34
SHA256 88b787db1eb0e288244906d028449e4ac8b9031886c97bcab13d4b6a965f6b02
MD5 1cbf15ca1bb09dabcc0509fa3e17ea59
SHA1 0a2461f6179f08464620f9bcfb763caeec6e6466
SHA512 62bbda46b919ed8c15bbcee2877ce12ad61aefe10feab5bc242a2b5f7d7ff0456ce562c8c90d69cc15ed60463f77374f28b769ec38e91a4dbc4e4d8faaadd0f0
SSDEEP 24576:AP0JmOLiu5MlqqY4cL2oxjnuELzS2lZee/nN1lb7meM7MLJ6S:Y00OKlq0CneOZee/nN1lb7meM7MLj
TLSH
T17925AF5AA7A805ECC1B7C17CC6578657E7B1700D0370ABEB06E086A52F13BE56B3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6056	cmd.exe
3820	cmd.exe
420	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4856	timeout.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 6056	3420	seggs.exe	90
PID 6056 wrote to memory of 5496	6056	cmd.exe	91
PID 6056 wrote to memory of 4332	6056	cmd.exe	92
PID 6056 wrote to memory of 4104	6056	cmd.exe	93
PID 3420 wrote to memory of 3820	3420	seggs.exe	94
PID 3820 wrote to memory of 420	3820	cmd.exe	95
PID 420 wrote to memory of 4856	420	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\seggs.exe
"C:\Users\Admin\AppData\Local\Temp\seggs.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\seggs.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\seggs.exe" MD5
    3⤵
    PID:5496
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:4332
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:420
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:4856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads