6495dd80f28bc378dce38738f933e6035fa721e51422edfc64af497b7cc39572

Analysis

max time kernel
148s
max time network
190s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 09:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vehicles/sdd_g82/jbeam/AirLift/sdd_g82_AirLift_F.jbeam
Size 5KB
Sample260803-k79rhsshle
SHA256 6495dd80f28bc378dce38738f933e6035fa721e51422edfc64af497b7cc39572
MD5 35587682e007631f5752b61de0167622
SHA1 490f617ab690e15022dbeea2cc0e69b794ea70e9
SHA512 f2afef06ae042083848db0a263e31dfb64ae99184196f2adb4f6c96913d69d2bb7fe8821c4292779234e699c88525e26a8c419052ab869afce7e4f6974875cb2
SSDEEP 96:sQiqKcbPVVPbf2s2KiVioiviLuiqKcbPVVPbf2s2KiVioivi2:sQiqKqenKiVioiviLuiqKqenKiVioivP
TLSH
T1C7C1890DD052CCFF457899202A562087E8A47BC7B5B41E5AF2BECE144FB8874860DA3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1644	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1740	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\vehicles\sdd_g82\jbeam\AirLift\sdd_g82_AirLift_F.jbeam
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:1644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads