cada12bd6dc8d9a06a77b99c6d64459033d906182119f510af61811a1084af6f

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 11:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RUN_ORGO_UI.bat
Size 160B
Sample261113-nzxc1aay91
SHA256 cada12bd6dc8d9a06a77b99c6d64459033d906182119f510af61811a1084af6f
MD5 45edb4a99d71fc6fb936c0c40446c113
SHA1 34a8b1533bf24aadd412ff4b56ecc23f98d4c129
SHA512 08cb5f2fdeb2ea1a0835a308ff6d8e54eb27affab3f2e4afd438c9d979f93b3159e42e0ca1f3d150150f2960f8def8d23981bb77ee3cfc6453dea15102a78535
TLSH
T1B9C080169177233A72F548056F8D1558752C46A55155F8943565711C2187C5B9C8E091
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5908	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RUN_ORGO_UI.bat"
1⤵
- Executes a command shell one-liner
PID:5908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads