2fc76f633f34187e23794969d383e135248430e62f0294918587c7a9234e5d6c

Analysis

user interaction
yes
max time kernel
10s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
klipa-player_0.1.0-1_amd64.deb
Size 9.6MB
Sample260805-ba2vzavdph
SHA256 2fc76f633f34187e23794969d383e135248430e62f0294918587c7a9234e5d6c
MD5 78a0a42d3c8cbb0fcc043a4c573bbc62
SHA1 477d76ebfe496e249d0acc92f80e3220a509dfeb
SHA512 53d8ad8c6ff4ad5512a38ebf9319a3b4359f05e1f2b663ac58ea0eeb7d5a99aafe75a57018fd74c86b72cdafa11f19de4870628041d05b5c13f10f74d25a6244
SSDEEP 196608:7BQzMCETTVN5A21oWMRo6F7Mg+C6PIDZ7OL1Q0gt4xL1hIjLb:2ICEtN5/1//6NMg+3IDZ6L1Q0xN1h83
TLSH
T1A9A6333A52CB3925A46EB7341B179E8DCFE20A737B7884D9ECDD4E09B72C22858C54D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1548	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5180	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\klipa-player_0.1.0-1_amd64.deb
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:1548

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads