5e3bc22f8a03c0c9724fd5b819f95c307de6a0006ff92f44afa212183f1becc5

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
203169_4159211050702832863.manifest
Size 55KB
Sample260703-v5r4ssh19n
SHA256 5e3bc22f8a03c0c9724fd5b819f95c307de6a0006ff92f44afa212183f1becc5
MD5 4e45388e26f8cd91fd46c1da5a7f33d0
SHA1 39e184dc4375d9227095446ddbcc30f9312cc518
SHA512 5f469f49df411487424084ae38a750aecf9ae1c8d7e7b506889477d359aaeb93ea0164a66e7a653506382837c238f96a3ddcbc2f8a5d6309c6cf4b8ba9429228
SSDEEP 1536:aO3vqf7jeOP/QTNCusyETTVVKriTspm36qZ:aO3vsjuTDWTTKOQpZ4
TLSH
T1944309542971A4F7724D86AB1C1CDA1F9FF43EB31B1025A1CF9AED1A0C8F982279B531
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5992	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\203169_4159211050702832863.manifest
1⤵
- Modifies registry class
PID:2900

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5992-0-0x00000182A7780000-0x00000182A79DF000-memory.dmp

Download