8275dd4546a235eeb507f6bac3116267debffab7aae40356912e9b9b326df304

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tidy_old_versions.bat
Size 2KB
Sample261029-1p2k7ae18x
SHA256 8275dd4546a235eeb507f6bac3116267debffab7aae40356912e9b9b326df304
MD5 261b145f9ba1c709d5ecbfa2abdd7c99
SHA1 5ab1d9db41d7564b096ae8bcad5c44cd059ec357
SHA512 39aecfee931399f5be435c5b7f58121fe4263adc16b221dab11ff5e4c4e8cf4b3434aa1dd7f9e1bf9baf33f2399ffc14393db39e23ce295d5dc59d76bad5eadd
TLSH
T16E51003AAD918D75C486C6660E230A9CF30640BF56A45B5C381E427F2FA97EC1BFC0E1
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3016	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Tidy_old_versions.bat"
1⤵
- Executes a command shell one-liner
PID:3016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads