cdb6cdb335f003406a9031048984c9b3c058366f4357e9063c06e5d262b8c997

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
assets/fancy_foliage/models/block/foliage/flowers/easter_egg/lunar_lily1.json
Size 2KB
Sample260421-nvhdaahs9v
SHA256 cdb6cdb335f003406a9031048984c9b3c058366f4357e9063c06e5d262b8c997
MD5 add2b6bb75962ae4a406fbb4bea5c448
SHA1 f99c6ebf9505ccadf36309fea9bc74b9b726e17e
SHA512 358f6fbfe556bcfc67c4422d9feb99cfb7cd0fb6f2e21501e3a9c909441746e971e3eac878705f8a7fdc621d0d53331dcd34aea47b2c28da249267521492b183
TLSH
T182418DD74E2F96B3084AE98D103E8EC2518CD1F5129C88DEBB7E9C8CC2DCC2415EB225
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1232	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\assets\fancy_foliage\models\block\foliage\flowers\easter_egg\lunar_lily1.json
1⤵
- Modifies registry class
PID:2648

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-1-0x000001B7FB3F0000-0x000001B7FB4C6000-memory.dmp

Download

memory/2648-0-0x000001FCC1500000-0x000001FCC15D6000-memory.dmp