10fa2a6611495b7f7efdb0bdee44c205bf266ad82b87184f3b28d1ab3d7be246

Resubmissions

23/08/2026, 00:24

260823-ap12jsgh6310

23/08/2026, 00:20

260823-am41eswsas3

23/08/2026, 00:16

260823-akqd9acr5t1

23/08/2026, 00:12

260823-ag7jcsv1az10

Analysis

user interaction
yes
max time kernel
104s
max time network
110s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 00:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MoltenHost.zip
Size 32.8MB
Sample260823-am41eswsas
SHA256 10fa2a6611495b7f7efdb0bdee44c205bf266ad82b87184f3b28d1ab3d7be246
MD5 b7810f2c0cd2f5b4f60e2bc2725370e5
SHA1 a19bbab1d7b4e4b227a06011e8db752bfa7bc3ca
SHA512 df7e078262cc355b72adff98e056ad89447a9a7b69e087456fe122c541af056a85f7f63bb45f2ed677809f499f901fca78481b244905d54f7c8c5dd1927d287d
SSDEEP 786432:TIh4pCwK7D4kE9RvIs9dZhVla8B379lZKtVe2POjWeQ060fBRWRJ:2uCwsD/2RlPfrX379lgVe5TB4f
TLSH
T1C677330D39FDC26278B871B44939F8CCC5E64F90D02BA129E35F78189A9F957ADC10B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3412	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
5552	timeout.exe
3976	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 5552	3412	cmd.exe	90
PID 3412 wrote to memory of 3976	3412	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c "timeout /t 20 /nobreak >nul & ""C:\Program Files\7-Zip\7z.exe"" x ""C:\Users\Admin\AppData\Local\Temp\MoltenHost.zip"" -p123 -o""%USERPROFILE%\Desktop"" -y & timeout /t 600 /nobreak"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\system32\timeout.exe
  timeout /t 20 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5552
- C:\Windows\system32\timeout.exe
  timeout /t 600 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads