cbfbf255c5312c6c90e50376cc4efeddab0298d38ff5d5c184e44f737eb96b38

Analysis

user interaction
yes
max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 09:26

Target
Risxn's Process Lowering Pack V4/2. System Configuration.lnk
Size 1KB
Sample260717-lem8gsbz21
SHA256 cbfbf255c5312c6c90e50376cc4efeddab0298d38ff5d5c184e44f737eb96b38
MD5 e602273d1838007a65f3f9cb356f48fe
SHA1 580df21aefd12f983fddfb3768d8edc7457ee3a3
SHA512 af661631d4c7205f2e7018c2cbed28481af65f424f8537353d4edecf5d371c8b70377ece530a9184925aa1c521c5b89ae56fbdbe0f9afeb0df24474ebf02f7a7
TLSH
T18B210D2B05C00B36C2B14E7784B7F3038F21FE26A8939EAE84C062C458A1516FC35E2F
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4172	msconfig.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4172	msconfig.exe
4172	msconfig.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 4172	3472	cmd.exe	90
PID 4172 wrote to memory of 4544	4172	msconfig.exe	91

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Risxn's Process Lowering Pack V4\2. System Configuration.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\System32\msconfig.exe
  "C:\Windows\System32\msconfig.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\system32\winver.exe
    "C:\Windows\system32\winver.exe"
    3⤵
    PID:4544

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact