511534779c6b8328db751c7d50fd16c24b2991ff7d6d79062c94c718fa92b6fc

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Between Us - Copy/data/3CutuDl2Ghep.ly
Size 8.8MB
Sample260816-lmamcsce38
SHA256 511534779c6b8328db751c7d50fd16c24b2991ff7d6d79062c94c718fa92b6fc
MD5 047830edfb5f48653b4fb55b99fe4f35
SHA1 08aaa15690c93a9c30d8ed3b3f992468b321e832
SHA512 110137bf12e3b0583d5e7b499973ae554ac1832b0fc8b4fd1c6b6d414989265ed9826776442748cd67024ed92ceb0fba70df7b980b1e339d7b1c1afe655e9e29
SSDEEP 49152:YLkI/TdtZ2+lVd+Um40ruj+sieHYF5LgIWfWv3REb7TgIEJWtmdY60qGyabBMlVj:4Ux33oYt9nf
TLSH
T19796A40A787B14544EA38F4F8FFA18A607BB490844DF905B54D7A3C8CF9F96735A243A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2500	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2424	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Between Us - Copy\data\3CutuDl2Ghep.ly"
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2500

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads