e5ea09ba0ebe799f710a4e0359bba6320e8f9f39ebb185004bdbe17c1f44b093

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e5ea09ba0ebe799f710a4e0359bba6320e8f9f39ebb185004bdbe17c1f44b093.exe
Size 440KB
Sample260816-e2e23azbrh
SHA256 e5ea09ba0ebe799f710a4e0359bba6320e8f9f39ebb185004bdbe17c1f44b093
MD5 eb4e072db4993ce38f09b6c399788c0a
SHA1 fa2596c4ccbb47db3231e91ae4e97e51cc19dc0d
SHA512 f676f1c3078df4752124452970d195227665edb4b7916c842d34509f2a55b3df0e6368af2d7b753f00e23f4cbb7710920ed38a830f12f425452792d95bdf94ae
SSDEEP 6144:cae7jdQz2diwcIXMRxHHbh43He6iU8msBcywGRYQ9RARc/1wKHjlpfg2:gmiMZvN43+u85Bpw+YMRkc99nf/
TLSH
T1CCA47D19D7F405FDE1B7E678CD838902EB76784D47B1E68F03A499A61F232908D39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	e5ea09ba0ebe799f710a4e0359bba6320e8f9f39ebb185004bdbe17c1f44b093.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
236	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\e5ea09ba0ebe799f710a4e0359bba6320e8f9f39ebb185004bdbe17c1f44b093.exe
"C:\Users\Admin\AppData\Local\Temp\e5ea09ba0ebe799f710a4e0359bba6320e8f9f39ebb185004bdbe17c1f44b093.exe"
1⤵
- Modifies registry class
PID:5800

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.py

Path C:\Users\Admin\AppData\Local\Temp\Client.py
Size 2KB
SHA256 7ae655e3968da343b117ad0878e5f325b59252cf201bd0b06cfc50e4926fed2d
MD5 9aadc2ff52c2d0ebcbd97773757fad41
SHA1 a0b4b56f0d11c985db5308fb170334ea251233d2
SHA512 7f7bb044a7602da2c46d6719712ba3cc745e13454457fdf80f0d457180b8033236754672680f6ec44dd185b9e3e0a2d389d76d547a263e2f40bb6a568703975c
TLSH
T103514DDBCC6E4F20828ADBA59DA8BC9D455B30D7BF27940058288F3050A0CE0DC1135D
MD5 SHA1 SHA512 TLSH

Submit Download