2dd031d7a3afe9fdd98359d9814e706f96fa7f6b04d3d5eff9ca397d036902ea

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vendor/bin/cexec.cmd
Size 3KB
Sample261110-pl98dattey
SHA256 2dd031d7a3afe9fdd98359d9814e706f96fa7f6b04d3d5eff9ca397d036902ea
MD5 ca4cdab544f34220cf87f55c25df9619
SHA1 49313cc3b913d398e46e6fe42ce5aaee3b9489ac
SHA512 c6c92dd92f57ee2732a5a98b583c553541f438839039246b066b3392c5c34ca9fc22d0030d85ad290e52fb786b0502fd7fb7473305db83e88290f8ce5aa681a9
TLSH
T15781931A7919A257F8B88B214D718072F31E23EF34405E4A343F52742B1A7C2B3FEA85
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
968	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\vendor\bin\cexec.cmd"
1⤵
- Executes a command shell one-liner
PID:968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads