896493804df881a8d5780e950548509017591be56b3ec28f7af74dd6d4adf24e

Resubmissions

13/11/2026, 02:51

261113-dce54aez618

13/11/2026, 02:46

261113-c9sxsay15p8

12/11/2026, 21:38

261112-1hhvhacv2z

12/11/2026, 18:56

261112-xlfb1aaa978

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/11/2026, 18:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install-windows.cmd
Size 5KB
Sample261112-xlfb1aaa97
SHA256 896493804df881a8d5780e950548509017591be56b3ec28f7af74dd6d4adf24e
MD5 1519b393ebe34bbc3ee9124ab385a1d4
SHA1 d852aae8e5f015d87c4d5bf3d8afbec55b80676e
SHA512 26c23d28a5b06297908dac1ab494c33dc7df59b74ef1a5df9430c944ac34142ab1e0cfc6866a78d4acceec25059bd613d3fc8bf03a6bf12f2ac8682753f75192
SSDEEP 96:chw3clDPLCvnHI1Q2+JWoJPboJXChSvRICXJeGkv/afFy4hv:53clzLCvnH/2+oo5b6XChpCXJeGtdy4Z
TLSH
T1D3C1721E3F11917AA5F9C7D457255100F709F0431B68EBAE309F22BA631A3EB21AD783
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
11	1828	curl.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4600	cmd.exe
1384	cmd.exe
5044	cmd.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 5596	1384	cmd.exe	90
PID 1384 wrote to memory of 1828	1384	cmd.exe	91
PID 1384 wrote to memory of 3712	1384	cmd.exe	92
PID 1384 wrote to memory of 5044	1384	cmd.exe	93
PID 5044 wrote to memory of 2864	5044	cmd.exe	94
PID 1384 wrote to memory of 5844	1384	cmd.exe	95
PID 1384 wrote to memory of 4600	1384	cmd.exe	96
PID 1384 wrote to memory of 4500	1384	cmd.exe	97

cURL User-Agent 4 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	5	curl/8.8.0
HTTP User-Agent header	11	curl/8.8.0
HTTP User-Agent header	17	curl/8.8.0
HTTP User-Agent header	19	curl/8.8.0

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\install-windows.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\system32\where.exe
  where curl.exe
  2⤵
  PID:5596
- C:\Windows\system32\curl.exe
  curl.exe -fsSL --retry 2 --connect-timeout 20 -o "C:\Users\Admin\AppData\Local\Temp\awgbv-install\awgbv-windows-amd64.exe" "https://github.com/RoninOnis/amnezia-browser-vpn/releases/latest/download/awgbv-windows-amd64.exe"
  2⤵
  - Downloads MZ/PE file
  PID:1828
- C:\Windows\system32\curl.exe
  curl.exe -fsSL --retry 2 --connect-timeout 20 -o "C:\Users\Admin\AppData\Local\Temp\awgbv-install\SHA256SUMS" "https://github.com/RoninOnis/amnezia-browser-vpn/releases/latest/download/SHA256SUMS"
  2⤵
  PID:3712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /i /c:"awgbv-windows-amd64.exe" "C:\Users\Admin\AppData\Local\Temp\awgbv-install\SHA256SUMS"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\system32\findstr.exe
    findstr /i /c:"awgbv-windows-amd64.exe" "C:\Users\Admin\AppData\Local\Temp\awgbv-install\SHA256SUMS"
    3⤵
    PID:2864
- C:\Windows\system32\certutil.exe
  certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\awgbv-install\awgbv-windows-amd64.exe" SHA256
  2⤵
  PID:5844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type "C:\Users\Admin\AppData\Local\Temp\awgbv-install\hash.txt"
  2⤵
  - Executes a command shell one-liner
  PID:4600
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Mozilla\NativeMessagingHosts\awgbv" /ve /d "C:\Users\Admin\AppData\Local\AwgBrowserVpn\awgbv.json" /f
  2⤵
  PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SHA256SUMS

Path C:\Users\Admin\AppData\Local\Temp\awgbv-install\SHA256SUMS
Size 692B
SHA256 9c026cfc96edb599cbae24ecc09701858efbdb6c6fd791abbd5e1ef56d94a8a9
MD5 c6c93ae51d31d534101398b1321b5fec
SHA1 e1f13e5a9f2649880fb844646a35b8a10d359907
SHA512 bd7e6ddc13a5b9e748bed72b615d52412da0f54ab819282b8f64948cb16c0b9029839359636787d2a175a363d0e6499de8737cf818759ca042392ceea77c0d7a
TLSH
T1720123D4B34B1635AD773F52C7AB2709F268013AEA80F609947DE2E9114F00776814DF
MD5 SHA1 SHA512 TLSH

Submit Download

awgbv-windows-amd64.exe

Path C:\Users\Admin\AppData\Local\Temp\awgbv-install\awgbv-windows-amd64.exe
Size 10.2MB
SHA256 5686a01240a7311897ce4bfeb5942ba1a1811792d9578661b5e9070bf76a41e4
MD5 d2da1b43f05fca4192f0f135d846c6db
SHA1 a0e48adcd1ee17d94a5cd5d92eeda8e64a57a816
SHA512 9c44541bb807010d1358b916ca9498c7015404bc4f125e613fc32dd5286db540c341bb48ebd964fc45640b6eb0db3167a4a31179537dabf8dec7dfb95d4a5cd6
SSDEEP 98304:gG7iETS+Oz0f2Hy1cKgQAgazmXTF6cEE:hA+OzbHNKgQAbMp6i
TLSH
T1D7B63947E8A915E8C0AED231C57295237B32BC490B3527E71B50F6386F76BD0AEB9314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hash.txt

Path C:\Users\Admin\AppData\Local\Temp\awgbv-install\hash.txt
Size 208B
SHA256 a21a84e856272e368ef67514984dbb4ac981be4c1594a86589cbba83fb0f0dae
MD5 ce4ce5eb4239c36ff223a8f106bc54f7
SHA1 0c24de1e85cc81cc0b43f247aef7a93d3b716ed6
SHA512 f463e65cec116ea5eaf65cab43765c350c9394592ab74fb0e95b9607d64a17eb4d2e040a0c6cc52e8c1bfe4713553d5935c2017df4560587620a8a8e0c8f098d
TLSH
T165D0220183CE4A7D8AAB2ADBD0E7B30DD1420B48AE4A25019234A1E9030B403F98B487
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads