68cfee5caee25321e0190815b4abdd8e208fdfbdb4dac1dfc3168fab480604a5

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bin/Updates.bat
Size 1KB
Sample261030-2sca5ssvbw
SHA256 68cfee5caee25321e0190815b4abdd8e208fdfbdb4dac1dfc3168fab480604a5
MD5 964be95db8fc4b0cc11bba08f07da0d2
SHA1 8d654e1a61f790eff9b707b697854e8bbfeb0299
SHA512 92991b2ecf98de0df2dc0efcc0b8756daa8d128b822f67e04b0f37058dc20a94db9c5772759c083b49149934649c6141bbf6bdb1d7248df3b809d97864a65f9e
TLSH
T1F2214BAF43899254FCF10FAB799BD3E4A89F900145A021A2FC6214B6F86E12066127D6
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4140	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bin\Updates.bat"
1⤵
- Executes a command shell one-liner
PID:4140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads