44594f2ed6d11d65023596d704d33df1a7846f3d6b2470e99be1d8b324144926

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Списки 01.09.apk
Size 10.0MB
Sample260802-pkhfzaan7v
SHA256 44594f2ed6d11d65023596d704d33df1a7846f3d6b2470e99be1d8b324144926
MD5 0b4309364a0af57e9d489a82070897ac
SHA1 78787372d7e824a29cf73bfb841a7bdbddb1f119
SHA512 ca79ddd2534b4f256a91840c4898d2073f77ba0ce9ee0fd19e452cc4ed43172552f7e4727c6301617786449066fca1284a4fe6b6839a32d5a903c57d8db6324e
SSDEEP 49152:xLjByemMqOScotCAezEiFWMK4k1oCWv+L3jYndXkpRo6EwbEgk6Q2ueJKbMSOR+y:WemMqB2zNFWVR4wb/yeJsLOR+khKAb
TLSH
T12EB6AF16FF0D0C32C58EF3B429D74B96E739E28B5643E74B2D1089887C931D86A167DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3116	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2152	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Списки 01.09.apk"
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3116

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads