6a4b60012c7de6f60cc34558d1ca9c56f6c2baf69d880f103257a57fb138b202

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tiktok-Booster-2.14.3/languages.json
Size 24KB
Sample260807-13c5ravbmd
SHA256 6a4b60012c7de6f60cc34558d1ca9c56f6c2baf69d880f103257a57fb138b202
MD5 e74ffc644712dad5e1231d4d67c9387f
SHA1 fd95023c372ccc4e328e30cfd6c6ad1a8b3f3926
SHA512 f8905ec3e8efd82ed1477d8039828e61bfe9d3d73e637501f6f943681fa58e7ceed0b577ae12d7d9e7e80646e12d06245edaf928606fdf842790759ede35f20a
SSDEEP 768:azwnUX8jGboAjZr/XTKgYf1O+NbuCoQGWNRDRn2NU9tkplPwTlUbCdp3Md:uzoid0v2pQlUbB
TLSH
T17CB2DC29D1B90C3F8076A336BAAC9702E491973B6185DD0B3F7D519D0F76103848AFAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1072	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5508	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Tiktok-Booster-2.14.3\languages.json
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:1072

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads