7d9ccb5fd3e4d960bd4ea55f40c2922023880d4cf7c32bc4abe9220e2ed68ebd

Analysis

max time kernel
149s
max time network
115s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
data/flutter_assets/AssetManifest.json
Size 1KB
Sample260503-exmlcabv9t
SHA256 7d9ccb5fd3e4d960bd4ea55f40c2922023880d4cf7c32bc4abe9220e2ed68ebd
MD5 d4e32a5468bd982cf633073536bdc4e1
SHA1 d321e3baad1b1a65a1e2d517fe09364534a431ec
SHA512 2e98d237445139f25543ad6b02f7bfb2b3651fda5a51e6030b9772fb3ffa5fc0462cb8a7ac36230dee73a49c381a630c11ff1d21c3509552e13ba450e1985b46
TLSH
T159318F00C24031DB3D9EB51A35ABA6998D451228AD94E7CE373D6D75B2C2C46013BAFE
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5056	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\data\flutter_assets\AssetManifest.json
1⤵
- Modifies registry class
PID:2572

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2572-0-0x000001D5E7620000-0x000001D5E76F6000-memory.dmp

Download

memory/5056-1-0x000001BE0F480000-0x000001BE0F556000-memory.dmp