7765d1af97d87737ab70ace2b6e3b979c8911683f1ab1049922552af86b80280

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SetupRU-RU.bat
Size 21KB
Sample261026-3vs74szxaz
SHA256 7765d1af97d87737ab70ace2b6e3b979c8911683f1ab1049922552af86b80280
MD5 2075bf806d5c7909dcca4869291e6da5
SHA1 236a96ce31411501e03c609953dde74b29db43c5
SHA512 3628829c10c8c690aaf686520144be1172a82c0e878a7e7a947165a259fb7facec151688f917595c2847dad3dc3848ddeb16e2c9690246f2a30d0f541f22e7fc
SSDEEP 384:12aOy15UP/dIO0TK62IIugli4V7Cqtqz4jUHTEvTERCG1QiqW69u2nZjQFasLF71:hsdIQjligjUHTEvTERCG1QiqW69B50
TLSH
T113A20BB33419677301288E624AB1FCD6FE4A18CBC424984CB19F94E51F78895FEFE496
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1804	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4328	timeout.exe

Runs net.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 4884	1804	cmd.exe	90
PID 1804 wrote to memory of 4620	1804	cmd.exe	91
PID 4620 wrote to memory of 4428	4620	net.exe	92
PID 1804 wrote to memory of 4328	1804	cmd.exe	93
PID 1804 wrote to memory of 4196	1804	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SetupRU-RU.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:4884
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4428
- C:\Windows\system32\timeout.exe
  timeout 2
  2⤵
  - Delays execution with timeout.exe
  PID:4328
- C:\Windows\system32\choice.exe
  choice /C:123 /M "| Введите ваш выбор ╚→ :" /N
  2⤵
  PID:4196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads