cd89ebd98d089390c92a4a2f0d3ebc69b06398a5014c5cdff77552b6cd158f93

Analysis

max time kernel
149s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.rsrc/ICON/5.ico
Size 1KB
Sample260913-wtawtabn81
SHA256 cd89ebd98d089390c92a4a2f0d3ebc69b06398a5014c5cdff77552b6cd158f93
MD5 bce8a2e304cfcfc383cd59a8a58f9092
SHA1 89d935ca844041587199e07b789d81a5f0a68d70
SHA512 8ab62fb8b4ee53f5c8da04c3e13ecf6e1ac874bb2ec22fd97303d56d16b45e957a1d12b32685e968eb1e7503ec490769c9c1e6c6cb77cfa08a9541a9517ad80a
TLSH
T12F31F8667FF49257D65C2C34A4AB1130FC2ABC05FB75992A41B3BBBB087C2F8590146E
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4896	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\.rsrc\ICON\5.ico
1⤵
- Executes a command shell one-liner
PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads