31cabc8d04d1633be48a2b0697087eb16cf540fb6d835e3a1c0fdf74f526a4a4

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
files/lang.cmd
Size 30KB
Sample261030-2sca5ssvbw
SHA256 31cabc8d04d1633be48a2b0697087eb16cf540fb6d835e3a1c0fdf74f526a4a4
MD5 2f869fee108ccf1e5e882785b0f2cca1
SHA1 89ed3a1a0f7064da1bdfe0254f1b735f59710daa
SHA512 a358294c2f47f88e5be756cd433f99b8add8b330435ecd9e1547dad1b3d99c4feefdfdbf3556a91e2a3687b8a5bf11488a6b2c0932944cdb4d8e066f91ee897c
SSDEEP 768:1GUJ9T6vKsM1o2dek19eaDV2oXYnNvV7AT5:1hJ9mvKX1o2deseavYNv2F
TLSH
T12FD2A5173E05416901FAA231918B6A49F72CC4DE9325E9CC342D801F63BFB63D6BE5E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3164	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\files\lang.cmd"
1⤵
- Executes a command shell one-liner
PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads