b89a66f0764075ba046b507a4dd913c7c97841b5a81e310d66bc08055c9f0760

Analysis

max time kernel
149s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 12:26

Target
Nekomiya Mana.blend
Size 22.6MB
Sample260507-pmlw6sdy21
SHA256 b89a66f0764075ba046b507a4dd913c7c97841b5a81e310d66bc08055c9f0760
MD5 95b0e89a7ac59f139bed0e13b4b5d3fa
SHA1 4cdac859ade15a69bbf930ba9fcb8812a72801c6
SHA512 f44ea84a65981ce648eeee5c96f378a11e890069a4afcaf53cb04f4985b23a03b7bb17354c6b9dd57d11bcdaa44d2bf434ab1c270b79417e7319558af0447450
SSDEEP 393216:TnE+6vdvh8+qqQiIhmqtiOJvVhbGQfXeeCXuvwKfwrHrD+QI1yBQxJ:TwhfqqQhAqMSrGSONuvDfwrjI8GJ
TLSH
T109377B62FA816ECDC225B632879F1F3D97A2CC3C8E2747679224735C5DBA644388315B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3948	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Nekomiya Mana.blend"
1⤵
- Modifies registry class
PID:5004

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact