514b88287afaf98d03ea06dbe9959dd21afad1bea34fd1877d2097f823895e43

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
src/input_48.sdata
Size 603KB
Sample260722-ccrnfstycz
SHA256 514b88287afaf98d03ea06dbe9959dd21afad1bea34fd1877d2097f823895e43
MD5 4de5ad0f15280d3752b517ed18e42a10
SHA1 df23cbcb810c25e2b6d5b989554227ebcb32355d
SHA512 1a7287d4797ed271f0d1ddba2ee92d56b2853672c3b9b92d65a763a8ff8db0489e3c95f27d9c5e4bff022fbf14403b75ca236c17c5cf2d2d73539e09dc5bdbd7
SSDEEP 12288:v8jeuPrbiWL2UaLbBvhP0kii7JZCRODwr5OHsY+ZhfehnPTNE:v8jpPrbYUaT7sODR+ZsPTNE
TLSH
T146D423DC2497F3A4E473CAE15346B5470B924A9AA467D03C09B7BDE7BF3B2160C51A32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2776	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3520	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\src\input_48.sdata
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2776

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads