b67a470f23b00a8d6e732c4e5135a39b224511e0b71809d5f4616adf62674980

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lua/zapret-lib.bat
Size 90KB
Sample261027-mxff2adc64
SHA256 b67a470f23b00a8d6e732c4e5135a39b224511e0b71809d5f4616adf62674980
MD5 387a52c6a18bff57072e6dac3084781d
SHA1 884fe05ac90882191d574ae631ae2ef6c40bd8d7
SHA512 e17a90764c095b5723e5bf8a57ef80b1a80b0ccae8e4d278cb973c05c5f8ad04a2525cc9ee199cb1d8c248c039fe659ae0ac3fed6a2f16b9b748b89ad6be6717
SSDEEP 1536:84Oc4TT2a12F79QbbHR6UCfdmYBGhmgrgyf7KXq:8Rc4TT2wfx6ddzurgyfAq
TLSH
T1929309CE37AAB2AE168032B5C00F2E517E6CF676618CD615E0CC81B5750969FD1F3A78
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5028	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\lua\zapret-lib.bat"
1⤵
- Executes a command shell one-liner
PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads