7075e5b8cdfda69ee25f83e414ab073035cc2d2e1a286ad0c9eb6699c82d1b19

Analysis

max time kernel
149s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.rsrc/ICON/3.ico
Size 3KB
Sample260913-wtawtabn81
SHA256 7075e5b8cdfda69ee25f83e414ab073035cc2d2e1a286ad0c9eb6699c82d1b19
MD5 a0332000cff957d6a7160cfe336d93e4
SHA1 713d6d7f6c0ee82d1209dca926b9e5adb50ecdd1
SHA512 7cc586ec188d17f49cdd3b0db158b66bedbd379c19905665867c8ce38b0b80829dd862881d4820f3f5d856c98a2f56b4a3b74d8edc4cb0f0a87a5fd1c4ccbfe3
TLSH
T15E71B70133E7A90BD80B9C39FACA86B11CCE6B00F13755AD49B21F63D9844B0502D11A
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3028	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\.rsrc\ICON\3.ico
1⤵
- Executes a command shell one-liner
PID:3028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads