6b9c1d7dc3ba26c50cdcfd33c6d3740eb27d8d8f6f0270b81df8f4e7f52f44c3

Analysis

user interaction
yes
max time kernel
598s
max time network
491s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/10/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
READ ME PLS!!!!!.txt
Size 48B
Sample261023-ep7asacb78
SHA256 6b9c1d7dc3ba26c50cdcfd33c6d3740eb27d8d8f6f0270b81df8f4e7f52f44c3
MD5 aaade2d9f99e6b05a9a4eab22e14f743
SHA1 361fb82fbd0f2469890ec5be10b5296b8f35ca60
SHA512 610b562cf392fe815a4647590d8abf5d406d89a93d1b4c95d0870ad2e1b2d0ba29b92b5722a812d25ac78c7ec9ce8dc301c88f1ffe8926ada124f178bef9e286
MD5 SHA1 SHA512

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4512	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 3224	4512	cmd.exe	82

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\READ ME PLS!!!!!.txt"
1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\READ ME PLS!!!!!.txt
  2⤵
  PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads