80f35bab348d2fd0bfeba37b6a8431a2c052d724d3441314b692f997df9a0aef

Analysis

user interaction
yes
max time kernel
8s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MacRecorder-0.2.0.xar
Size 225KB
Sample260424-2kb1eaew2m
SHA256 80f35bab348d2fd0bfeba37b6a8431a2c052d724d3441314b692f997df9a0aef
MD5 422529f1b603c4793d7040a3f166ddcd
SHA1 99f96c4619742ff30aaebf1781fe3781b5a73008
SHA512 2578bb46dca283ae9ba2ab596efa741be17d758e9ef972eb8fd564e6116a1553350dd4551e2cd18c0391ed7d50a531495ccbce739404d867e7e787c171ca186b
SSDEEP 6144:hlPiwwldHR6IqwUdhc8j8/DNcxROAPriGcli1eG3l2x1vy:hlPIp0uZcarGc01TW16
TLSH
T1FC3423ADD49498603D9964A7FD7AF23B382F29440537E06396F4C5B0E2AC787C370756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3708	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MacRecorder-0.2.0.xar
1⤵
- Modifies registry class
PID:2292

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2292-0-0x00000215B6560000-0x00000215B6636000-memory.dmp

Download

memory/3708-1-0x00000265B5430000-0x00000265B5506000-memory.dmp