47576cae321c80e69c7f35205639680bf28010111e86e228ed191b084fac6b91

Analysis

max time kernel
148s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 21:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Conversor de balances\_internal\_tcl_data\encoding\cp1255.enc
Size 1KB
Sample260810-zy2f4sycpd
SHA256 47576cae321c80e69c7f35205639680bf28010111e86e228ed191b084fac6b91
MD5 6dea4179969d6c81c66c3b0f91b39769
SHA1 7e2722576bffabc3258c5edb2d99fa2468d6a4b0
SHA512 91cc626b6454517f06fb3616e9ed623d1a2a4bfe74afa9885f00f6aec835d8825a5587091b9d9ab0e5abda291fa3fe7ce87e2618e21eb2974d9118ae27b8a2ff
TLSH
T189210A200629CDD9FA6F31D520ECF770157B35E3D2C9625036BC8248EB96E8A1DC8ADD
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5128	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
564	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Conversor de balances\_internal\_tcl_data\encoding\cp1255.enc"
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:5128

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads