f52f2dcd8c567c97e2889397b192465683d277d7aeb70bb78b7e65534d29fe6d

Resubmissions

06/07/2026, 19:59

260706-yqvsxsgx8r1

06/07/2026, 19:58

260706-yqcbksgx8j1

06/07/2026, 19:56

260706-ynph5agx6j3

Analysis

user interaction
yes
max time kernel
18s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Portmaster_2.2.1_amd64.deb
Size 120.1MB
Sample260706-ynph5agx6j
SHA256 f52f2dcd8c567c97e2889397b192465683d277d7aeb70bb78b7e65534d29fe6d
MD5 c3b3113171f5c0ae208c04e978160bb0
SHA1 73be1a60a598ada740b7f8384ca948ebc2b907a2
SHA512 1afad0c3b3dc0c1fdb3e419a9e4b01d2e68871fed1449aef604f10e5cd115c3b3adbd696004fce295f28c1d1b258d5021a868076f7b065d85856a0e705882459
SSDEEP 3145728:4QVsBaWaVSHD8fdagn31mvKZ3D/Z45OucALm/Q7Rni1BCqWcK:bsBBqwwJ31mvKZ3Dx4KAC/Q1i1BCqWx
TLSH
T1BE58335CC3A368A660594B2A2A1DCE2132273AB4C35115C7DB5BC1B1F7C7AA748DFCD2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5948	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Portmaster_2.2.1_amd64.deb
1⤵
- Modifies registry class
PID:2504

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5948-0-0x000002AF09420000-0x000002AF0967F000-memory.dmp

Download