6c6c1ab3d666de84fa515329bac7818340976cfbd211bf684703451b4842f700

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BUAA-WaterPoweredRocket/运行组件/配置Python环境.cmd
Size 1KB
Sample261012-29cm8sfa92
SHA256 6c6c1ab3d666de84fa515329bac7818340976cfbd211bf684703451b4842f700
MD5 75b00b7fe17385eb7f49e6e8bc9c8b2e
SHA1 a8a61013338454a163e310a22039e5e2d0021242
SHA512 55dce49a70630605b6dc8755d3fafa0d8cf91cab600d4b78a5886eea360a242c558618bf3a1cb92b909a6ca76596858dc8e4a6c5083768b46422b392ed490b8f
TLSH
T10E2133223442D0B2A958294FD51F416775E972F703E89CCD38F2E0E49C8D0A17F6DB26
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4936	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 2796	4936	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BUAA-WaterPoweredRocket\运行组件\配置Python环境.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads