76b562da4b3e6b20c8b23b261fce2632053e31cb41e3d92a85908825ce4049fc

Analysis

user interaction
yes
max time kernel
149s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/09/2026, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cd_popup.bat
Size 266B
Sample260920-ythyjayz8l
SHA256 76b562da4b3e6b20c8b23b261fce2632053e31cb41e3d92a85908825ce4049fc
MD5 77452ad41c677bf6dd6997b680cbcb0a
SHA1 35c45f17c47cb7552e5e5d30c65e48b90aa9c6b6
SHA512 68f8a0552f468672d91ca189f4b5ae5ca3baa249221993cffa96d132aeb70ba6ea2c44b66b93dd7be90000ee70e7877c43958253af91d04dedac1ca7b9afc85a
TLSH
T10AD05B01487BD35DF5A23A6076819058D744D4F5A5132004FDBD827F27841759F3645F
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2484	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cd_popup.bat"
1⤵
- Executes a command shell one-liner
PID:2484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads