9fe709a77ab9073a903922a88f242f997985fb62e997e1c876685a67beac54cd

Analysis

geolocation tags

cacanadananorth-americatoronto
max time kernel
149s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 11:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app.asar.unpacked/node_modules/lzma-native/src/index-parser.cpp
Size 15KB
Sample260809-nhs91sac38
SHA256 9fe709a77ab9073a903922a88f242f997985fb62e997e1c876685a67beac54cd
MD5 62f707e008a9e9656f6930705405501c
SHA1 e6cef294446b49cc31a0c60f3e7b50c2cea1e512
SHA512 b7333cc3ec85fe2245c18ef3f12d62daee5d28a7adfba5287718cafa5d14420db4cd6bde2c1a6fe5d5ff7b7274a36919771269192cda2913bb174f71cffc347d
SSDEEP 384:P1xt2a2ZRg2dAfWV+xPd4jcHZ5xoXk7nImQdjgcr1:eRFy5xY4nImQdjgQ1
TLSH
T1656276761E6E851B3D20312D190E4DA1B2FE5023B6D9CD01B959433C7AE603CD36FEAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3964	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1028	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\lzma-native\src\index-parser.cpp
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3964

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads