d8a597e18a29274fa845e1924d92eb0a32a919c5f11d633823310a4f3212bba1

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
assets/pleasurehorizons/geo/nude/jjsis.geo.json
Size 493KB
Sample260722-mtm2pstbpf
SHA256 d8a597e18a29274fa845e1924d92eb0a32a919c5f11d633823310a4f3212bba1
MD5 50e8447f6e4c1b737b8e05d8d4c58d47
SHA1 dc02b4138c4ed6d84dd669355a3669b8c6fe5e90
SHA512 2cda55a042e856b9dd125d1d51b062b493ae7aeecc428f1bd7a64a8386b6e7fd09cffbdbe56a6703ac89fbaba013111eb3d860474fb003227a1ec8e585da786c
SSDEEP 6144:LC4xjn/opE5Xxr/xwRAY7AbzPGchRF5eDTJVXXC:LC4xjn/lPGcPF5e7i
TLSH
T1D4B4339B8B4EC27B6654DB4A083F5EC386AC40FA15C847E6B6791D09E380E7C107BB35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1888	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1612	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\assets\pleasurehorizons\geo\nude\jjsis.geo.json
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:1888

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads