dcefa33dc5f80ad1e64f6b7fa4d85b60fdae39ccb4e3faac97fd667dd39657ff

Analysis

user interaction
yes
max time kernel
26s
max time network
30s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/09/2026, 19:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zerotemp.exe
Size 939KB
Sample260906-ye3dmay1cv
SHA256 dcefa33dc5f80ad1e64f6b7fa4d85b60fdae39ccb4e3faac97fd667dd39657ff
MD5 042091b459f45b258aa0f69e2fc0c74c
SHA1 839f84084c7daa9fcce4fe3c1202a7c6c16a05c3
SHA512 6cfeb5a9e091b258ead22717a2be385b86b98ad7c3d8ef1fd1a69e70949912eb85e80a39916214c127fb1faf4626652f2eff3925f5efd42ae830e35d906a80ac
SSDEEP 24576:6qj2gI/AtsYxMXBFCGrBBuQbPbHu2u/VbBnY/1jd4:6qCN/AtLfGVTHu2u/VbBnY/1jd4
TLSH
T12E159E6AA7A401ECC5B7D17CC61B8A07E7B270490320A7DB16E0C6A52F13BE16F3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
952	cmd.exe
2984	cmd.exe
4204	cmd.exe
2420	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1248	timeout.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 952	5084	zerotemp.exe	88
PID 952 wrote to memory of 3516	952	cmd.exe	89
PID 952 wrote to memory of 1868	952	cmd.exe	90
PID 952 wrote to memory of 4596	952	cmd.exe	91
PID 5084 wrote to memory of 2984	5084	zerotemp.exe	92
PID 2984 wrote to memory of 4668	2984	cmd.exe	93
PID 2984 wrote to memory of 4400	2984	cmd.exe	94
PID 2984 wrote to memory of 1840	2984	cmd.exe	95
PID 5084 wrote to memory of 4204	5084	zerotemp.exe	97
PID 4204 wrote to memory of 2420	4204	cmd.exe	98
PID 2420 wrote to memory of 1248	2420	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\zerotemp.exe
"C:\Users\Admin\AppData\Local\Temp\zerotemp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\zerotemp.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\zerotemp.exe" MD5
    3⤵
    PID:3516
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1868
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Windows\Temp" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Windows\Temp" MD5
    3⤵
    PID:4668
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:4400
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:1840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo SSL connect error && timeout /t 5"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads