ed1ddcf4f303f25a61bca3682e1746782e492fb8b6b33e72f436cfaa2afea2db

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
河边的错误.Only.The.River.Flows.2023.CHINESE.720p.WEBRip.x264.eng.srt
Size 60KB
Sample260820-rbdgrsdg27
SHA256 ed1ddcf4f303f25a61bca3682e1746782e492fb8b6b33e72f436cfaa2afea2db
MD5 7b51a6350ff6119c65595047454f7b57
SHA1 b0f253ac3c035abea9c22d84f9238ab371636a8e
SHA512 ada46ff68422b432af92aa86d85091cf1b1dd68c7085406b5c3ff6db6b7313e054b80e4633ab433eefff7289076ea6abeb258740cce12392cb9409d494c4be54
SSDEEP 768:aP6VT0Gfh2GAEa/xqxgXNLtBS6xkm5pRRsKIFEBXzhqEIiYS/ioug4FFcLxy5ft:aP2D6/x7XNLW5FEBDhqE9Wn
TLSH
T1A45362D597B70A3538B223A171DA3943B249876F22FC90B077E418DC3E5A2065B762FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1684	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
932	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\河边的错误.Only.The.River.Flows.2023.CHINESE.720p.WEBRip.x264.eng.srt
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:1684

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads