f652b2eaef87fcad6ad38a1d41a337028a7353db2568f69a303a579e4d8eb3fc

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
How to Fish/~Common Redist/aio_installer.bat
Size 3KB
Sample260822-d2s39aea99
SHA256 f652b2eaef87fcad6ad38a1d41a337028a7353db2568f69a303a579e4d8eb3fc
MD5 98c016af18a4f654fbb05fc168b9e495
SHA1 7ae8cb6a197929713d5c635383706af81f31ff2d
SHA512 252764cb8cb4a6ae34bb222d8995fa8d8701a29d7aa73d4df49a80a0b5d42d6744e76235a10cd2045c96c12afed0488418749862b29e42a1265b79a5ee110387
TLSH
T155611C3C340822FDB7719352C53E0682B658A18B4F22BC7470DB9578277AB8468FB4C7
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5388	cmd.exe

Runs net.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5388 wrote to memory of 4992	5388	cmd.exe	89
PID 4992 wrote to memory of 4552	4992	net.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\How to Fish\~Common Redist\aio_installer.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5388
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads