00ce37f92228600be2049a60cd81316ddb29483ed4855a0f4bed64e5141e67b6

Analysis

max time kernel
298s
max time network
206s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/03/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Unwwoven/materialiseredes.ini
Size 444B
Sample260301-ryw8dsd18e
SHA256 00ce37f92228600be2049a60cd81316ddb29483ed4855a0f4bed64e5141e67b6
MD5 ed1e938777a58a3ce9e86edd91cb1d18
SHA1 e58bbed42189147e03b1c4b0256c3fb192e13234
SHA512 aafcdd9534661b3cde3e452ea86ba44eebda2d2eb2ae89af50e70bd190cdb6762585e1ee7de417a048eb4ddaffc31e6977e9c1412487ab70532d66567767d65d
TLSH
T1ADF0DC28D600D411ACC38665FC6345690DDBD20B891A29F87122536C4B13D2432EEF9C
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3152	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Unwwoven\materialiseredes.ini
1⤵
- Modifies registry class
PID:4456

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3152-1-0x000001EE1EAC0000-0x000001EE1EBAA000-memory.dmp

Download

memory/4456-0-0x000001D4E6950000-0x000001D4E6A3A000-memory.dmp