7122e30e161c23e5111fc784d11dd5f3bce5ba2a382b7e7d86ed4d5af7a6f904

Analysis

user interaction
yes
max time kernel
16s
max time network
14s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
divine temp (1).sys
Size 32KB
Sample261012-ynh2caas9m
SHA256 7122e30e161c23e5111fc784d11dd5f3bce5ba2a382b7e7d86ed4d5af7a6f904
MD5 e03fe33b6e04f06886d04708770387d7
SHA1 5c6f1d83793fc7678d643990ae32bcfd1bd5ab35
SHA512 e843d26afe53c09360e9f51bd75f03abe2048fef2ef26fc03bd5028f32565cb1d9a490b476a2721d07a4a61071a34fa6c250d367b8355a03b57e692864b995ca
SSDEEP 384:HztVRdFf06hAAq5/7kR5r72Wb/wfT3iEx7bLDUNXPSV4:HzjRdtDr/i3iUbLDUNXt
TLSH
T157E207A13E2814FADCBA703DA145402EB532B19E0361F2CB959D9325DE32ADD5E353C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4800	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\divine temp (1).sys"
1⤵
- Executes a command shell one-liner
PID:4800
- C:\Users\Admin\AppData\Local\Temp\divine temp (1).sys
  "C:\Users\Admin\AppData\Local\Temp\divine temp (1).sys"
  2⤵
  PID:436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads