19b2e7d286585a2f57693afea586228fcf4004ee7e4cb143129da80e83137245

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VolcanoExecutor/locale_data/es/feedback_lines.json
Size 8KB
Sample260807-rr3rlafm51
SHA256 19b2e7d286585a2f57693afea586228fcf4004ee7e4cb143129da80e83137245
MD5 8ac5a50afa69293e5888b9a9e2fd709a
SHA1 c02a0d9d2f3786e422faaf7ff5a7f3fd693639a3
SHA512 040c26b3fdf594e2ace29c1c1b9911158ea640fb3274b46dc656e57589e13e45e50e4cc10105a0581724b9b55fd49bc1c807d13d8bced1318eb3dcd9904fa0d1
SSDEEP 192:HwMDblXp54ktQFOg0bGNmnOHoPC2OZn4LvqVYUNii1:tvlZaktdgsNnOHoRK2vUDAi1
TLSH
T11F026134CA4F4B3B0253418FD45A52D3611D892B4B6B216577A9C20C2ADE05FA77B0FF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4588	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2824	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\VolcanoExecutor\locale_data\es\feedback_lines.json
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4588

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads