597cb480ff60a1169b72f50df355256fefb23e5bcc03b382b1be07428b14821b

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 11:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Launch_MULTiSmartDump.lnk
Size 1KB
Sample261113-nzxc1aay91
SHA256 597cb480ff60a1169b72f50df355256fefb23e5bcc03b382b1be07428b14821b
MD5 a30e358fa27b45588a5476c123b5d870
SHA1 0a087bb1273cd2ccd1d0eddc4f74d69d93bb34c8
SHA512 17609510b7fc64333eb417e5b4278b48e41899acb7ff9109fa911d5137a1967d54d7761f5283a4d841e7a547cf026c12178fab150b217d36e3113d3157d10bc0
TLSH
T19E210D23463D2716D3F73273176650410B33B667B665690E8600520E4CA6EB07C6932B
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1180	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Launch_MULTiSmartDump.lnk
1⤵
- Executes a command shell one-liner
PID:1180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads