47ea05b9c698bd49ad9a86036a13712ead900b31eb9f3f0b8882a32a33c66b57

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 12:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
新建文件夹/wxrjsqxyz.sys
Size 89KB
Sample260822-p3qkasvbkf
SHA256 47ea05b9c698bd49ad9a86036a13712ead900b31eb9f3f0b8882a32a33c66b57
MD5 d90148d58a7e53c4cc07ac5d051d8f9e
SHA1 020b20ee131fee2fa6629dcfa8ced60657a66b2f
SHA512 c7fbe42a532122efedce3ec5d1da80f19315cfa00930955f519101094002269a674a4828de534f78601e9aceb08f69c9787ce3ce72cb71b1cd1b08013fa98000
SSDEEP 1536:d9a8PGsyXylc6daSyOX9RjA0DDs3oUzQ7gZa+7gZS:LG1ol8Wc6sT0N+d
TLSH
T183938EAA419410F9DD0BC574DAF8E667DEB6B0522F3097CF13A0C6501F92FC26A7C295
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3832	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\新建文件夹\wxrjsqxyz.sys
1⤵
- Executes a command shell one-liner
PID:3832
- C:\Users\Admin\AppData\Local\Temp\新建文件夹\wxrjsqxyz.sys
  C:\Users\Admin\AppData\Local\Temp\新建文件夹\wxrjsqxyz.sys
  2⤵
  PID:1564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads