152d4b39b7ec4e74c2d4f41225440d9018eeebc694b6f4be35af69ec3dbd34df

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lighttpd-service-tools-v1.1.1/lighttpd-service-install.cmd
Size 3KB
Sample260925-pmlleaea89
SHA256 152d4b39b7ec4e74c2d4f41225440d9018eeebc694b6f4be35af69ec3dbd34df
MD5 ac9d7c1411348ce907422c26bc05a6d7
SHA1 e9a6dba66720024af1574f522d8954465dc20370
SHA512 8a0d940e4c2477783d329f8243388be29e965a17a5e3698b3dbd9f5da64cdd0b16c95bcba8cb4124d3f6c882b377127b3ca62de8228a13798222c606b05c1f76
TLSH
T159610ED619D906E051926383BF43D206D22BB286A90D6A4936DDF80E1BCFF5C44BB4DF
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1260	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\lighttpd-service-tools-v1.1.1\lighttpd-service-install.cmd"
1⤵
- Executes a command shell one-liner
PID:1260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads