efbfe672f08e384cf022bd9722e5b83ca75f602b53fc0d389525b179303897f4

Analysis

max time kernel
898s
max time network
486s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/07/2026, 18:04

Target
autoexec.lnk
Size 2KB
Sample260705-wnxtdsav3l
SHA256 efbfe672f08e384cf022bd9722e5b83ca75f602b53fc0d389525b179303897f4
MD5 fb5ebf1ae11a1059b54a7c1cc769ead1
SHA1 0d4b9b9c8aa8833f2a4c91f595c915f82926a2c7
SHA512 d66e93ebcb0b496c38b1c9b3468125240530b568de9993cc3c8454aa0be96353ed09337d193195b71e9a0c4c2ae280f36f29f5cebea6df05801e48c8ea269c01
TLSH
T1834115035FE60521D3BFCCB91EBB340A8A677262BB4109094114D68E1C71D17ED2AB1F
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\autoexec.lnk
1⤵
- Modifies registry class
PID:1072

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact