cmd — Malware Profile

cmd is the Windows command-line interpreter that can be used to interact with systems and execute other processes and utilities. Cmd.exe contains native functionality to perform many operations to interact with the system, including listing files in a directory (e.g., dir), deleting files (e.g., del), and copying files (e.g., copy).

MITRE ATT&CK techniques (6)

• T1059.003 Windows Command Shell
• T1070.004 File Deletion
• T1082 System Information Discovery
• T1083 File and Directory Discovery
• T1105 Ingress Tool Transfer
• T1570 Lateral Tool Transfer

Attributed threat actors

• Orangeworm
• BRONZE BUTLER
• APT18
• GALLIUM
• APT10
• Volt Typhoon

Read the full analysis on IntelFusions