4508cf1c5cd9513d4022c7615a0143019a25948ee8104088076adac21bb148c1

Analysis

max time kernel
298s
max time network
280s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/03/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Unwwoven/microcrystal.ini
Size 475B
Sample260301-ryw8dsd18e
SHA256 4508cf1c5cd9513d4022c7615a0143019a25948ee8104088076adac21bb148c1
MD5 8549757f86e08bc0b16672f35c24cb6a
SHA1 63124a6764b4b97369dbab6a02d10e397014f8d1
SHA512 dd0decf3fdaf787d3f428ac2797b42535de4f5aa4efa18c898652c38ab86cf410336f79caf3e3f00f023ccccec13ca83cbf753d1241f0d097620960b825beb7f
TLSH
T1B3F09E601F5173710C7B12E5344269A554CD3229206D4D33DCD89682C01EC64C7FD849
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4136	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Unwwoven\microcrystal.ini
1⤵
- Modifies registry class
PID:2780

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2780-0-0x000001785BB50000-0x000001785BBAD000-memory.dmp

Download

memory/4136-1-0x0000027B6BC10000-0x0000027B6BC6D000-memory.dmp