05bce537b3500ee11a76ace4329ac294dec3a8b0f6d575713f36e9b82eb7a5b3

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TomOSINTWorkbench.exe
Size 2.2MB
Sample260813-ph23layhmh
SHA256 05bce537b3500ee11a76ace4329ac294dec3a8b0f6d575713f36e9b82eb7a5b3
MD5 e7c30a6f11430eae418a445c2851ad25
SHA1 cbcad6b42fac26a7318e7cc1b5c90f003d419eaf
SHA512 f44a5b4d8d380b395b7ac5fc5a3109cacb9c23d98c5b07e0d38df62d4461efa6fc063f9461f7b4bf39a202dec9c10244075b0fb952875e134560cbae417b680c
SSDEEP 49152:5eIxqWvhcQcfj3lAgEWq7LCx09OeGT3PWk+C1:cIxqn3WgGCxmOeGrPc
TLSH
T1A2B59D1763A401FCE0B7C2B8CE465A13DB71740A1371AAFF1690C5A61F67AE15F7A322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Colors	TomOSINTWorkbench.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	TomOSINTWorkbench.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	TomOSINTWorkbench.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	TomOSINTWorkbench.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	TomOSINTWorkbench.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	TomOSINTWorkbench.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	TomOSINTWorkbench.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	TomOSINTWorkbench.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	TomOSINTWorkbench.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	TomOSINTWorkbench.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	TomOSINTWorkbench.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	TomOSINTWorkbench.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	TomOSINTWorkbench.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	TomOSINTWorkbench.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	TomOSINTWorkbench.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	TomOSINTWorkbench.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	TomOSINTWorkbench.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\NotificationData	TomOSINTWorkbench.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	TomOSINTWorkbench.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	TomOSINTWorkbench.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	TomOSINTWorkbench.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	TomOSINTWorkbench.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	TomOSINTWorkbench.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	TomOSINTWorkbench.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	TomOSINTWorkbench.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	TomOSINTWorkbench.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	TomOSINTWorkbench.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	TomOSINTWorkbench.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	TomOSINTWorkbench.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2592	TomOSINTWorkbench.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2592	TomOSINTWorkbench.exe
2592	TomOSINTWorkbench.exe

C:\Users\Admin\AppData\Local\Temp\TomOSINTWorkbench.exe
"C:\Users\Admin\AppData\Local\Temp\TomOSINTWorkbench.exe"
1⤵
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads