3035b30abe7c21186802f235084275a0effa887cee4b6e2736c443dff2901735

Analysis

user interaction
yes
max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sina Perm CRACKED BY SAFWAN120.exe
Size 2.7MB
Sample261107-sdw8bsy1cv
SHA256 3035b30abe7c21186802f235084275a0effa887cee4b6e2736c443dff2901735
MD5 ff28d996149f2b677f4ccb89ba421983
SHA1 51de7a7c38d05b6e883de32b15252a705104a392
SHA512 828d1140905a47e6b8ea7f4989194f3c7a20f400da4bf00fd997e61ba32ec653c9cce69a799795938972f30c5961923db5bb0926b17c5d1d5ea7fb3ca72f454b
SSDEEP 49152:V8q3njzIjDlnygMqfWjOFlW6cbODw7gOuUEMKnp/6n4OdFj:p3jzNklW6cbODw7gOuUvb4Ov
TLSH
T188D5BE07E36442ECC96B9538C6A68B47F3B5B8442311D7CF22E46B596F536E01F7A3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6080	cmd.exe
4340	cmd.exe
3340	cmd.exe
4500	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Sina Perm CRACKED BY SAFWAN120.exe
"C:\Users\Admin\AppData\Local\Temp\Sina Perm CRACKED BY SAFWAN120.exe"
1⤵
PID:4632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ResumeSend.cmd" "
1⤵
- Executes a command shell one-liner
PID:6080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ResumeSend.cmd" "
1⤵
- Executes a command shell one-liner
PID:4340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ResumeSend.cmd" "
1⤵
- Executes a command shell one-liner
PID:3340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\ResumeSend.cmd" "
1⤵
- Executes a command shell one-liner
PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads