d8e77031d7b2ed96d67788717df325981f8d89376b2d06215b13161012cb670e

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
🏁 Semaine de course !.msg
Size 103KB
Sample260421-ls68hsfs31
SHA256 d8e77031d7b2ed96d67788717df325981f8d89376b2d06215b13161012cb670e
MD5 83c2d3162f7a9858f83fe56ac52522eb
SHA1 dbdfa4983bfc0fc83234a30a6cf529d8d5834664
SHA512 022765bc798b90a4f3a0030e942b4030b3191f390e9b3af3ba145c3d98005ce1b0fa8e1b24ca66fc23a2dff771080a077791383a3ec21cd1b63af22009185b12
SSDEEP 1536:QzjePkjO9i6JW03vYYlqhKecxqNWsWXI7/jalG+8NGPWqKi:kjesjMvJW03v0hF6RlRfKi
TLSH
T116A353153AFA5215F2B7AF3159F69093893ABD93AD25CA4F2181334E0671A40DCB1F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4944	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\🏁 Semaine de course !.msg"
1⤵
- Modifies registry class
PID:4136

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4136-0-0x000001ABED970000-0x000001ABEDA1E000-memory.dmp

Download

memory/4944-1-0x00000210BCAD0000-0x00000210BCB7E000-memory.dmp