9bb5295690e3cffcb98cc22ef0eef405ffb56d7380dc18df4ab4e39b1e81de63

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
general__FAKE_TLS_AUTO_.bat
Size 3KB
Sample261029-vcb7waev5q
SHA256 9bb5295690e3cffcb98cc22ef0eef405ffb56d7380dc18df4ab4e39b1e81de63
MD5 3f92043d9205f66b2d331572e44a6b20
SHA1 5f28a14d755150aa3473128ef22ef55606adf54d
SHA512 62e81f82ec8d7a251ce15ea0f7e44ae5f0839ff077f3448e2d3ddaa519ec00fb83c26be34950a59d8b0a827fbafad718d7427f27578e9d05e1ac085983e398a8
TLSH
T1A8816D83E00DDE47F5CDB83EF86F76A821279C8328D5D852839A45E8DC4DDBE594B084
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3000	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3340	3000	cmd.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\general__FAKE_TLS_AUTO_.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads