3d9f56b0491f810b73fb579a83452b2eb9c6100e8cfb0ba2d03b9764f6b4da75

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
长春长生基因药业差旅采购情况说明/1/1/1/DIFxCmd.exe
Size 188KB
Sample260820-m6vmbaytex
SHA256 3d9f56b0491f810b73fb579a83452b2eb9c6100e8cfb0ba2d03b9764f6b4da75
MD5 1af3dddb16d6cc8021d915389beee217
SHA1 1bbe29c7c80f02265e767b99c7140088310c7cd9
SHA512 83d43b60b925eb8336dd1ca4f5dd29533c4577c6822330e6bbbe8db9324198bc54f4ec4a7455cd53cc23f865121def84b742fdb39302e7d6094b3a052a70e5af
SSDEEP 3072:xGSuoDOAiXRZ/GheObiHz4eTk6oaIOdKFBfVw/QwdC8ZdasKHCU0UarYq:xGuOLRqzWH0eT1FS5Ljq
TLSH
T11E14390673E520F8F1B78634CDB58546EB3378611730D6AF136482BA6F63691ED3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3884	cmd.exe
1256	cmd.exe
6072	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4820	DIFxCmd.exe
4820	DIFxCmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 3884	4820	DIFxCmd.exe	91
PID 3884 wrote to memory of 4856	3884	cmd.exe	92
PID 4820 wrote to memory of 1256	4820	DIFxCmd.exe	93
PID 4820 wrote to memory of 6072	4820	DIFxCmd.exe	94

C:\Users\Admin\AppData\Local\Temp\长春长生基因药业差旅采购情况说明\1\1\1\DIFxCmd.exe
"C:\Users\Admin\AppData\Local\Temp\长春长生基因药业差旅采购情况说明\1\1\1\DIFxCmd.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mode con cols=65 lines=35
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\system32\mode.com
    mode con cols=65 lines=35
    3⤵
    PID:4856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c color 0A
  2⤵
  - Executes a command shell one-liner
  PID:1256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:6072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads