bb9f35262f088b15f98f5f67204fcd9cef03def819745c99c14444fa9d728e3d

Analysis

max time kernel
149s
max time network
101s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/02/2026, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vengrom executor/Bin/Monaco Editor/vs/editor/editor.main.nls.zh-tw.js.map
Size 51KB
Sample260210-ytssqsa19a
SHA256 bb9f35262f088b15f98f5f67204fcd9cef03def819745c99c14444fa9d728e3d
MD5 e9ec0d4da76e25502ff8abe77ee74234
SHA1 0be5b7a9cc39cf9222110ff56e9102a5dfaa14b2
SHA512 c778c65d16fc4c2ad0c14e5a0d7ad27dbae56934b534eeeecff0ff58bf95df6def32d4fc0017ce2d7038ef8089edea3a3552dcdcd4d0dba3202e8a01cca02e55
SSDEEP 1536:XMUC7Sj6HWA2HnMLDT7q/EygCY0nTudBkzbbGeAs4/o:M1LH7LA
TLSH
T14633B3E40ABBDE94244C6F7DF7571F8538CB6FC6BA21218160EDF9A70982144F366D82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4916	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\vengrom executor\Bin\Monaco Editor\vs\editor\editor.main.nls.zh-tw.js.map"
1⤵
- Modifies registry class
PID:4348

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4916-0-0x000001D012560000-0x000001D01267E000-memory.dmp

Download