175ba47374a454c690258b0d9d25b81c2133d0deccf9e5f1a9993c8ecf24099b

Analysis

user interaction
yes
max time kernel
93s
max time network
96s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/05/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
YUB-X/Scripts.lnk
Size 2KB
Sample260507-c8jbysat4k
SHA256 175ba47374a454c690258b0d9d25b81c2133d0deccf9e5f1a9993c8ecf24099b
MD5 12b71bcec9cb8254176a8d2408ba7468
SHA1 93d38ee0a0cc454c0a496ce69a660666db73cdeb
SHA512 c17c706a5cdb77864ae5a88af6407227686fa995db7ec334f7a5a121a9afb4a54ff60a8acfe07622ed3870766d70ec9dbe08739926b2b9113ffff6a5bf1315d7
TLSH
T1EB4140102ADA4722E3FF8CB512FB7660CA29A792FE824A18818500952DA1B15DC34B0F
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 5 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3431708735-1789331158-1295227519-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3431708735-1789331158-1295227519-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3431708735-1789331158-1295227519-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3431708735-1789331158-1295227519-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3431708735-1789331158-1295227519-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\YUB-X\Scripts.lnk
1⤵
- Modifies registry class
PID:6076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6076-1-0x000002082FE40000-0x000002082FEE9000-memory.dmp

Download