fba0364b82f8c20e9204bfa1e81bf81ddf34d65a005b25f8ebea66b8ac1048db

Analysis

max time kernel
38s
max time network
38s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
start.bat
Size 34KB
Sample260823-xbe89aba46
SHA256 fba0364b82f8c20e9204bfa1e81bf81ddf34d65a005b25f8ebea66b8ac1048db
MD5 b1b0c2bc78a7aed524430dda789b5ca1
SHA1 841fa70e3803793b205239f6f633d6a405909d6e
SHA512 9b1519c3a48cc4fb65b68c4faf13e14409b2e1906205c662fcde76d69de3ec4aeab9b4bd5b009d4c23f80632488ea2978c16d543b833cdd476312ad32ba2228e
SSDEEP 384:kqHAC5RCE3utFcIu7P8AIKoPamn+CtIajLLjCXpEakDi5h6wUEz+oi0fOQwG8ITd:kqHAC5t0KWaYw1h+nzMKJc
TLSH
T1F4F2722B2401586204B193B3D96240F5F75A81D3073666DE38AEC098BF7E76395EF6EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2624	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\start.bat"
1⤵
- Executes a command shell one-liner
PID:2624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads