6d12d961ac8e7ed617e8a46e837a4810baa124aa149e2ffbcd3511afbecf7e1b

Analysis

max time kernel
149s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Crack/Keygen/Check_Disable.cmd
Size 2KB
Sample260910-txhpqadr7z
SHA256 6d12d961ac8e7ed617e8a46e837a4810baa124aa149e2ffbcd3511afbecf7e1b
MD5 86e1d0c712554c1871a78f61b5d194e7
SHA1 62c5a5d7c8873d33634f2e30dbcf43046badb74c
SHA512 627e605f42e006dfca7b221a20fb73ad66fa86a489844fb013c1cb8c1113a72a9fdf47d20df893eaeb69239fe5bae920fee3fe35e4c72a12c9de707a80189ba6
TLSH
T10351680D1F48E92E44703134498B55BF2B2BF356EA9EE844352A9C47D322AED4539CFC
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
660	cmd.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5080	ipconfig.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 736	660	cmd.exe	84
PID 660 wrote to memory of 5060	660	cmd.exe	85
PID 660 wrote to memory of 4548	660	cmd.exe	86
PID 660 wrote to memory of 4632	660	cmd.exe	87
PID 660 wrote to memory of 2628	660	cmd.exe	88
PID 660 wrote to memory of 4408	660	cmd.exe	89
PID 660 wrote to memory of 5080	660	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Crack\Keygen\Check_Disable.cmd"
1⤵
- Drops file in Drivers directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:660
- C:\Windows\system32\find.exe
  FIND /c /i "na1r.services.adobe.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:736
- C:\Windows\system32\find.exe
  FIND /c /i "hlrcv.stage.adobe.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:5060
- C:\Windows\system32\find.exe
  FIND /c /i "lmlicenses.wip4.adobe.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:4548
- C:\Windows\system32\find.exe
  FIND /c /i "lm.licenses.adobe.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:4632
- C:\Windows\system32\find.exe
  FIND /c /i " activate.adobe.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:2628
- C:\Windows\system32\find.exe
  FIND /c /i "practivate.adobe.com" C:\Windows\system32\drivers\etc\hosts
  2⤵
  PID:4408
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:5080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 846f8de43f87b0e6d180df9d6a1540bdd077d32b921c7dd8101aafc41c496fb1
MD5 4886588082a26c78445e14ae4e7a4465
SHA1 8e6c51ce4bbe1fd48a2cd611149c5ea4e5f28d10
SHA512 7fa1154f88cf969d8f928189c8d8533d2c24aec0bfd3b15ac1e36997444597fa6e471f96dce8019ff36a494e459b3d08e00c02c16dd90f1ad95c6ffcd39e48ad
TLSH
T1CC21BB2A0689915D26B341E5091CB42FA31FD1EF0E3B9D8D3F8E450F7BA2A0C532664A
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 aa4eb8ab1ae11b429c2ecab1c71cc3b837852530c78929ce6ae6caf40547347d
MD5 60f5ce7f8ef7aebe6580fda6bbc83036
SHA1 68e686bc1d16b551ab399297d80b82f3df7e2917
SHA512 a3d422fcdc04d42e089c7079bf48f077c329539b9ebfd8a6b376651a29191ddc7486034635645f08168c45d316da9f91889b11528bc7cf75c302513351349e5d
TLSH
T1E621CE260645955D22B34195082CB42FA31FD0EF0E3BDDCD3F8E450F7BA2A0C5326645
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 de5032274cd7edcc3b4ca4ca7cd1d7c0b6d6e89a31c68fa7e161a22820493757
MD5 3a48a0c59bc92d6b9a362a13676d5dfb
SHA1 bc07df5ef837470a46898d82db7c13cf7c780b7f
SHA512 d7c82e8d25f9d9bf4ebb99dbaebc95c84ba2c69d97737f3596ddb0676d666a9d662a9c20e681570e9150e6b376605420d7a3b25bd9d655f3bd4cf75aa280c48f
TLSH
T18C21DC2A0649915D22B30195082CB42FB31FD0EF0E2BDDC93E8E440F7BA2A0C1326685
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 ac19b1e1d72c193587f4b17823cd812dcd993f6a5b996ffac01164389694da77
MD5 982bd7a6f796024d1f33c6be4e689960
SHA1 e0e24240bb725d877d6cd6bf5726221dbcfe77c0
SHA512 a7daaabcc71fcc6aac9c8edfd12821f1abc5492aa5b50fda445893aea6e4cb48515f02213834f7ab1b06a8df01ebb7da43868d732b22d98f58266e87e91a2db9
TLSH
T12521CA2A0A49915D26F301A5086DB42FF31FD1EB0E2BDDCD3E8E450F7BB2A0C1366685
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 b8327bdb2996cdcc9d584d547fa967ff919bbc5c2f9ab3e7dfbfbf54faca4fe3
MD5 399c027ad2178a7202bc149fad0cf47d
SHA1 10f046201e943d539280d4ea6ea646e6774c3ab6
SHA512 d5b2ca823385013a2151949f2d5f3e3db3b79e974ba434abe4717d686b03274ead174339e8ce623da26706dcbb88af891730bb0ea2f5d6825b2ab00edcfcee5b
TLSH
T1C821AB2A0A45915D26F301A5086DB42FF31FD1EB0E2BEDC93E8E450F7BB2A0C1366685
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads