191b210e2d994c93cb62b247d3f8167ad01ee43f258576542db159959c508ba1

Resubmissions

04/06/2026, 09:55

260604-lx2tlact3x8

04/06/2026, 09:45

260604-lrfn6scs3s8

Analysis

max time kernel
898s
max time network
394s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 09:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-plain-1.txt
Size 1KB
Sample260604-lx2tlact3x
SHA256 191b210e2d994c93cb62b247d3f8167ad01ee43f258576542db159959c508ba1
MD5 5eea8b3c013ff8badccd133f9f4755c0
SHA1 77bc466fe2da3f3185ee50d9f9649f64883e187f
SHA512 876e9ec0c5772738c1134e2cdfacf0c53f9e9fd2cb10d7aae6ec0a24c5739c8feeb5552ed059eedbdb361f6925012b6d30dcf9e0ad3dc0294b4426f697e75b69
TLSH
T1513194A7C38E063352931049FC063582EF260458225F5A16746CD16553938ACAF7BB78
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2532	2448	cmd.exe	80

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\email-plain-1.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\email-plain-1.txt
  2⤵
  PID:2532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads