a2d350bf1c1c86a2e07c4166f8bbb2c6baaac9c34e38b4c553ca29526e04d084

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vendor/clink-completions/cmd_commands.bat
Size 28KB
Sample261110-pl98dattey
SHA256 a2d350bf1c1c86a2e07c4166f8bbb2c6baaac9c34e38b4c553ca29526e04d084
MD5 6d3982c2467328e4295491369cb6ac65
SHA1 ff7f1843c351304861c6615fdf093db8d9d4302f
SHA512 c2555db7b9a6173ae0a6117d334d1449e8b46d0313eb0abba547e0f22a9b29bfa36eac8b022b191fbcc1f8491f958ff6c83541dc2d1c78bc0bd16dd0f8863604
SSDEEP 768:30U2xqRp+SbgaiOm3xQirio2kASICLIYih1sZqr6o/R57WgZMC7raBiql4KhLgiz:ZTSQrtZ57WCMCH4e7erprb
TLSH
T195D2235BAD4109735283D9D8CD9B4D02F2795113060891A5FAEC05982F393AFEAFF3AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5744	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\vendor\clink-completions\cmd_commands.bat"
1⤵
- Executes a command shell one-liner
PID:5744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads