c60a4a9b460dd6756ebf66d78f1214ec2711e032d42b330add351ffe8848f12f

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
module_14.dat
Size 715KB
Sample260803-e9fcss11dz
SHA256 c60a4a9b460dd6756ebf66d78f1214ec2711e032d42b330add351ffe8848f12f
MD5 85dd8c72e6cd6e21f10d1e69fc705b32
SHA1 34ad7b0cc70af3c9c786a179362edbf29478a63e
SHA512 3ddd1273bb7e690f4e190038f94dbd3c738e4d6ff63977d3adfb42e68dab82b32f688a5743f601f408a7ed4abcc00df150fd850f92f2fb6a18fc16d7bb755468
SSDEEP 12288:fTc9vYp8Rom/NEM+5nb9EHCDRvE2AXv3J2wyQleyYOXlokzFpl1SMH6ZCmFv/:oTFEM+ZhEHCDifXvIwyQle9OVnrzStEM
TLSH
T1AEF433A4DD2317304AC32E581FF867CA9EC8A633742A3FA662A16F7D916DDDC45DC120
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3040	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4424	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\module_14.dat
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads