7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Between Us - Copy/Setup.exe
Size 102KB
Sample260816-lmamcsce38
SHA256 7123e1514b939b165985560057fe3c761440a9fff9783a3b84e861fd2888d4ab
MD5 0323998e0e85eca5fd90d9f8ecbbd6c2
SHA1 56dc080f728d7a276495d6a4371670f9ea71519b
SHA512 2b56c210d6c690cef89ca03563cec186576c50f6b1b60b287afd46a14cc5c9dfce31dd458066098951a79daf3b367fdb0787d3bdc74fbd8f69425877f263b0e5
SSDEEP 3072:53Yj+8JlFCumUbyJlKP8HRvkduTK5Nrh2o9Dj0fmoQ:1Q+IFCumUGekHRvEuO3go9kfnQ
TLSH
T167A3F206BB1615BEE922803EEA970666D7B0FB6217514CC71211A2301FB7FC19E379E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4700	cmd.exe
4380	cmd.exe
5956	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	Setup.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 4700	4104	Setup.exe	89
PID 4104 wrote to memory of 4380	4104	Setup.exe	91
PID 4104 wrote to memory of 5956	4104	Setup.exe	93
PID 4104 wrote to memory of 5824	4104	Setup.exe	95

C:\Users\Admin\AppData\Local\Temp\Between Us - Copy\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Between Us - Copy\Setup.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:4700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:4380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  - Executes a command shell one-liner
  PID:5956
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Between Us - Copy\traceback.txt
  2⤵
  PID:5824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

traceback.txt

Path C:\Users\Admin\AppData\Local\Temp\Between Us - Copy\traceback.txt
Size 1KB
SHA256 6bbfcba59e6e8aa3909c4580048663e665677c5d3e84bed307f5817578768290
MD5 2a837ca4d06a00dffcad5f924bae9bd5
SHA1 61e02b2123ea3e85422c2ea8b1158790f9a2c9cc
SHA512 c82629386a67429a3ea0a569d28f5167afd3c9d3a730cfb92ce4d2b39e55d981b88e8a835ca1ddb755a65b3f9040b763882559017366a992edc9ba42ee2f11fd
TLSH
T1F431DE684F85C2E31835C43B3361B80EF5A604277F485691FAF8C2D92B44129D5DEB8B
MD5 SHA1 SHA512 TLSH

Submit Download