7f7ba8c23075fecbd66d7be34f9bee2432f2df556aa23ac0dd14d0f52e43e217

Analysis

max time kernel
148s
max time network
164s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PlantsVsZombiesRH_Data/il2cpp_data/Metadata/global-metadata.dat
Size 10.0MB
Sample260807-28aggsdn9s
SHA256 7f7ba8c23075fecbd66d7be34f9bee2432f2df556aa23ac0dd14d0f52e43e217
MD5 85410585300e366dced22431bf178cbd
SHA1 78b1e191e0dac98d64f73f050fc60cda53ac0ba7
SHA512 d5fc488b808e5dd3a95b0ea9366d0764efc0ac077d6c6f6a33b2e69a70a5b11cc661ee24837b88524193797ae8e26667d6cce5498d35328bba261dca2481a99b
SSDEEP 49152:nLIH9XjwFZBdEBaGh+QBTB0Ahm34ZupUOotSr+fJMb2ZDUStvGh0D4hFpd0sViZi:UjgOSr+MkDUavG/0EgtTzDk9lc7FV2dF
TLSH
T126B6D7E1BE64CA2EC15563354AD7CAF46671AE4A0F12C2E77344B7AEB4761048F032F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7136	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4412	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PlantsVsZombiesRH_Data\il2cpp_data\Metadata\global-metadata.dat
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:7136

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads