2d10a35143c6e1f9b2759d4501702964bc41807e86bb7771dd6b7ca9ae70facb

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run_freakspan.bat
Size 111KB
Sample260922-mpql2acc22
SHA256 2d10a35143c6e1f9b2759d4501702964bc41807e86bb7771dd6b7ca9ae70facb
MD5 2a8425e662ef071c7ff40dac808cb993
SHA1 f0ce46b8cc2034eea63d5beff056b9a33c341673
SHA512 02e603435ae4e0ab20324cad045ef7bbcb60dafb768d8b0641741fbd0e425efd7be40271b7867afcec7ba042d95b4b24952dd3ddeb71ced0be1585bb88e5df87
SSDEEP 3072:qQmzRjPkDPRVawHuDU3mleiiO6Ar/eOtw/eIYiTV:q6HHvdiiIKTV
TLSH
T10CB3D657CE573DA2A7A4A2872DCDB9C21DEC339B30E304ED095BDA9893DC5A814F109D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6124	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run_freakspan.bat"
1⤵
- Executes a command shell one-liner
PID:6124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads