0a3563f0f5319da4fe85854e315a9f7f922b042dd6b668a7dc12ff9a288f4504

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 05:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Game/bin/Debug/net7.0/Game.runtimeconfig.json
Size 147B
Sample260418-fxefeahs3t
SHA256 0a3563f0f5319da4fe85854e315a9f7f922b042dd6b668a7dc12ff9a288f4504
MD5 fbe6c25cd10c2d663f42c9369255c9f8
SHA1 65b9634cfbfe928442f7ac385e2faef02c6f7c17
SHA512 b197e8cded768079593871524bc27193b626cf0e9827d7f3d1f18186076e251eb3c9197cd27087a467f85ef95ab0929a9c0a4825ddf636a2d02c2e97b13ea27a
TLSH
T1D2C02B26CD004D6321F517E6D0314180FE35C30710000465707D400C0F729270000F80
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1120	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2188	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Game\bin\Debug\net7.0\Game.runtimeconfig.json
1⤵
- System Time Discovery
- Modifies registry class
PID:1120

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-0-0x000001CC55AB0000-0x000001CC55B9A000-memory.dmp

Download

memory/2188-1-0x00000240D4720000-0x00000240D480A000-memory.dmp