f279c1bb9e45239038c277731c0ffb42b8f34785f3675408d877262dc60d7349

Analysis

max time kernel
101s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lua/desk.bat
Size 10KB
Sample261107-vbypgset7q
SHA256 f279c1bb9e45239038c277731c0ffb42b8f34785f3675408d877262dc60d7349
MD5 783553e63123756bd90a41d2e1b537a5
SHA1 05911700d0d1cd336ce0a6a31b592be974dfefa7
SHA512 47b168594a2a42c8d199569e1cba3630ec7cf013521b7112df85b73ad27901a69fa035636bbb36187ba7a385ae0ca0ef2900680173e67c0c18f3d6abd42b0e07
SSDEEP 192:L9MT1FnpcnOiZIC9v1cfEUCKVeCanGquoJZsISYFD1Mk+jmdi8aUVG7L61s5D9DW:aBF+dZ/WsnienGquoJXbF6sdXVG7ks5Y
TLSH
T14E22D54B72E32374636582325E1B6458EF389421432518EBB1DCE0983FA6A2DD1F7EF5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1276	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\lua\desk.bat"
1⤵
- Executes a command shell one-liner
PID:1276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads