5d31adcf8b6bf8ac1a5d04773b265da46d3b6d322f1352174b7bd9917fa42d4c

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/09/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TinaxxFree.exe
Size 44KB
Sample260901-2l9casck4t
SHA256 5d31adcf8b6bf8ac1a5d04773b265da46d3b6d322f1352174b7bd9917fa42d4c
MD5 34b558ed9ec540550a7c8b01ffd67b7d
SHA1 b115ad85a4601b5268aa530f61d1ab0e5c735463
SHA512 75ef906bdf386371c1fb68979e44961ca6045dac9cb0a6bcbd3971568460aad1ff23782b9d2c40e5136b2f5bc7d94248d9514e71047ab7a04badf81c5e70ce82
SSDEEP 768:rzqdx23CffT8Ym7aR5IYFXDE4x/Wt+55pQvKvc/r57DjAOsJ136gu:/qb2kC767ZW0pQz/r57DUOsGgu
TLSH
T146234B5B675900FCE0E2D2BDCA924986E3B2B8190B4267CF239192264F737D49D7B643
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
692	cmd.exe
1096	cmd.exe
4760	cmd.exe
988	cmd.exe
2992	cmd.exe
4124	cmd.exe
3408	cmd.exe
892	cmd.exe
4164	cmd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 692	3236	TinaxxFree.exe	92
PID 3236 wrote to memory of 1096	3236	TinaxxFree.exe	93
PID 3236 wrote to memory of 892	3236	TinaxxFree.exe	94
PID 3236 wrote to memory of 4760	3236	TinaxxFree.exe	95
PID 3236 wrote to memory of 988	3236	TinaxxFree.exe	96
PID 3236 wrote to memory of 2992	3236	TinaxxFree.exe	97
PID 3236 wrote to memory of 4164	3236	TinaxxFree.exe	98
PID 3236 wrote to memory of 4124	3236	TinaxxFree.exe	99
PID 3236 wrote to memory of 3408	3236	TinaxxFree.exe	104

C:\Users\Admin\AppData\Local\Temp\TinaxxFree.exe
"C:\Users\Admin\AppData\Local\Temp\TinaxxFree.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:1096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads