8b1a79bf058f4a08c676b60303443cfc781f11f278df803a6ff081dfacb033ac

Resubmissions

12/07/2026, 23:41

260712-3plababy6y10

12/07/2026, 23:35

260712-3kzl5sby5w10

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
idk/Pics.exe
Size 12.7MB
Sample260712-3plababy6y
SHA256 8b1a79bf058f4a08c676b60303443cfc781f11f278df803a6ff081dfacb033ac
MD5 46391a362acf636f78eae52dc808604f
SHA1 2eee0a2a8cb970a7d7406f8e96f4cfd53c36ea4b
SHA512 492274cc645c9c881c1f284b33d0f89d982ebd34c5237696e3f64b3a78fc91545339e40e6268a00e4e47f861eecee1579644564a208f003d6e18652cfe406f8a
SSDEEP 98304:3rYADN2oasx0662nPGnl9ijORZvlV57vDT8X5Z2g5qEo:3tJLNxCijORZJDT8JZo
TLSH
T1B1D66B5BE99905E9C0AED130C976E613BB713C484B2123D71B50BA382F77BD4AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-1667220282.tmp	Pics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1244	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 3648	4640	Pics.exe	88

C:\Users\Admin\AppData\Local\Temp\idk\Pics.exe
"C:\Users\Admin\AppData\Local\Temp\idk\Pics.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\system32\cmd.exe
  cmd /c start "" C:\Users\Admin\AppData\Local\Temp\ovld_2979087108\DevXplore_Studios_-_Dunny_Park_Stadium.rbxl
  2⤵
  - Modifies registry class
  PID:3648

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DevXplore_Studios_-_Dunny_Park_Stadium.rbxl

Path C:\Users\Admin\AppData\Local\Temp\ovld_2979087108\DevXplore_Studios_-_Dunny_Park_Stadium.rbxl
Size 1.1MB
SHA256 c4167607768f903e18c116fea25dffad988b085b6602167b0b97f2b2e8d7308f
MD5 387af6783e0cdbcfae6735c4708412e5
SHA1 46d7eb753a0b8d6b1c9f7b1d514cf2fec40b9bef
SHA512 4e674868c9eae52cffdd99863eeac094575bb4a7255928b8937bd6c860fcf64fd79e16b58fd543ca4100d5a3d1543063f107f5238b81142227059ff44bfd3359
SSDEEP 12288:v5lUOFf3US3ML8VR+Ly/u9HR9RpgGxWUPIqqshZFAA40KpMofSYn8W0ntYezAj6d:PUOUS+0QLD9HX9ZhxyQofSYn85WeBd
TLSH
T12745D0F1EA45C63AC1F350B3E9D146A913932EC89282A35BD1D4757339FE37827B6248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download