1ab0ca1e1f310cfaef7fe6c658791e6c2fc6353ed28f180cb508fdae130f75d3

Analysis

max time kernel
298s
max time network
212s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
08/05/2026, 22:49

Target
workspace.lnk
Size 2KB
Sample260508-2rnyjsft31
SHA256 1ab0ca1e1f310cfaef7fe6c658791e6c2fc6353ed28f180cb508fdae130f75d3
MD5 967dba684f8cee20392b496d5c3402c8
SHA1 63c50af553023b63d9bad858c6493472e0fe2eda
SHA512 ca2ba8e3eaeb65cc6122ec9ca9c9d829988892c971a6f459d97d7b9a0c8fd47ff32f3df7d27cd4b3644fe3aa5d6e6006037b653f057b72369cc7a4e7e8dcabeb
TLSH
T104410F067A9A5B21D3BBCC781EEB301A8A7A7262FB510B04412081C508B5D56ED35F1F
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2345208746-1589029588-866946394-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\workspace.lnk
1⤵
- Modifies registry class
PID:2724

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact