f75971c1f32bd15f785fdda97d28c77013b2c5ab3db0f2beac2de202b0140d7a

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mods/character-select/main.bat
Size 8KB
Sample261101-wvsg9ada22
SHA256 f75971c1f32bd15f785fdda97d28c77013b2c5ab3db0f2beac2de202b0140d7a
MD5 afc5522b7fd0e4675b7bfbc5ce93d9b6
SHA1 9dee1e886382b4c2b1ac437aeafebe0bd6dfe38d
SHA512 4ef48eba0f900b1b8fee52a584b1b83c6fcac70e8858a9a873a8a8155ce11420890aedbe85d7424366ffe01e9a0145d4195e5e6f011777c8d345b21937f7dae8
SSDEEP 192:+c8z2gBMqF4zV3cbwCnN+quu4WrGmvrV7dvX3IyjKprNa/Eh/:zUrFclclcsIGKprNa/u
TLSH
T1DB025296F611126539F38ACA8C877804EB1A845333670054770C99663FB5BBDE6F5B38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1212	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mods\character-select\main.bat"
1⤵
- Executes a command shell one-liner
PID:1212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads