f49b0b6a95b4962d541c4d294ff373aaf029a198f38d7f99ac40a4505ccfe263

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SahurTf2Dumper-main/imgui-master/.gitignore
Size 1KB
Sample260804-s74jhatend
SHA256 f49b0b6a95b4962d541c4d294ff373aaf029a198f38d7f99ac40a4505ccfe263
MD5 37f49fd23619ab4458cb0786863dbd63
SHA1 990055434ee4069ef76afccf830a54a701bcd0b4
SHA512 f43ccbb6c284842d7fd07bf24f3ed73008066f6ba05bce377887d610a831fc281310c10c36af235221c162c094a2ebf768dded2347f3adc44c75b4a143d58db9
TLSH
T1BA31E2E08B4AF05A093338CD702D9A6A997EC4C8D0E45CB4C6DDA39A2C92E87779D314
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4240	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2820	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SahurTf2Dumper-main\imgui-master\.gitignore
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4240

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads