6f3353354cff42e95ef8790577a95cda32533b382d8adf114e13822016d6e113

Analysis

max time kernel
149s
max time network
145s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/05/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
scripts.lnk
Size 1KB
Sample260507-db5pcses9v
SHA256 6f3353354cff42e95ef8790577a95cda32533b382d8adf114e13822016d6e113
MD5 c058a6177890b6c49b5a8e329396c72e
SHA1 8e3db24aeff63d714d501154fbdc25f6583e08f0
SHA512 430dcde2e8ac4cd77c28dcb365dcbdab9a19928dee4c15fbb75ab8c2933d83eb362311074770bc53a02859610afec1bf887cde656337843f22cb3935311c1742
TLSH
T1A531E0036E921715D3FBCD7096A672154E697E667D82AA4A5490810C2C3290AFD35F1E
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 5 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\scripts.lnk
1⤵
- Modifies registry class
PID:4456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4456-1-0x0000019E94600000-0x0000019E946AD000-memory.dmp

Download