102a4478ea62b031345910968c4cbf05fc7e1381630a29d44adde06a1b4fcb21

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.bat
Size 272B
Sample261102-p189matwfx
SHA256 102a4478ea62b031345910968c4cbf05fc7e1381630a29d44adde06a1b4fcb21
MD5 37869004ef524bacbb8813a3381d0d46
SHA1 b23f6ad1d6affe0b7a622bba226de934d18fb2ac
SHA512 c8a9c62cbf68a5080616fc1440a15f3fd3dcfc9665ee2502eb7d2d0954ad762e388c0e362d471d881df12690c488b41f679845280aa98a560ed96c4573d6d9e7
TLSH
T10DD02B227271708775CC7B04F08B2A79B5AFF1EE3402B468130C332630D0E6201C41C0
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4264	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 4164	4264	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\install.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\system32\xcopy.exe
  xcopy "C:\Users\Admin\AppData\Local\Temp\maya_umbrella.mod" "C:\Users\Admin\documents\maya\modules\" /y
  2⤵
  PID:4164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

maya_umbrella.mod

Path C:\Users\Admin\AppData\Local\Temp\maya_umbrella.mod
Size 60B
SHA256 9912fea2cf19d33ec44c412417e1177fcabc95142b77df6d1351706c0310ff91
MD5 ec7a0d13e18e65c97d67a669227720af
SHA1 395db82b87966c7cdc3665e247e65327fff12a87
SHA512 0f65d5daf7dedce4a3b797ba8c04775ecd376746af291cee0e579ecd97e545f35077d7dca3c23f9f0b8000b26e3e648035f6fb4fa4825b0158f0352f4de1a1df
TLSH
T15AA0024196C6D61914CC64574666E7CCC1F228087B996B609B10D61A217691AB5C1651
MD5 SHA1 SHA512 TLSH

Submit Download