63910e631d83f3ed6dd7c7b34203342aa384e314f02e20736eccb803a91a4e03

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.bat
Size 272B
Sample261102-p15w7swt9n
SHA256 63910e631d83f3ed6dd7c7b34203342aa384e314f02e20736eccb803a91a4e03
MD5 8a1fe2403ded844fc977ed3326a8cc17
SHA1 e6e4c94865536d70279327bb48c110bf0b0de48a
SHA512 4d8aa634fcab49e8db51319dbaad27fd4e73cce591387bc5a116a48b1e965d2d0b3c128a852c136ca2088ea8cd74cd6393acc338bce7fb29d0a1b3ec724549a7
TLSH
T1E4D0C2227271708779CCBB15F08B2979B56FF1EE3402A454130C322630D0E6201C45C0
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3764	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 2024	3764	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\install.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\system32\xcopy.exe
  xcopy "C:\Users\Admin\AppData\Local\Temp\maya_umbrella.mod" "C:\Users\Admin\documents\maya\modules\" /y
  2⤵
  PID:2024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

maya_umbrella.mod

Path C:\Users\Admin\AppData\Local\Temp\maya_umbrella.mod
Size 60B
SHA256 d951de3ceca06fe61c2690017c9e86032d2fc4bfefe9dad3d1d86165dd4af353
MD5 fa2b763d24ea27c38642dd9b4a7b10ae
SHA1 5ae9c591f15892991a00848e45b4a06817ef21dd
SHA512 9a4022b9d6d189ccb5b5d659de388b3ac1860bfe352dcc52881f363031f358f16ae2d322cf3be9e5a3a41e48f685ae48f0ba1cbb0f98fafd2f1ad0bb95da6a81
TLSH
T108A0020156D6D61914CC74678667A7CCC1B228083B49AF609F11961A116691AB5C1642
MD5 SHA1 SHA512 TLSH

Submit Download