a04a599b3d10b8d8a681cef932d22f2830c05144aa12461fbf822c9a858cae2c

Analysis

max time kernel
299s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
patch/readme.md
Size 1KB
Sample260824-p5dnhsde33
SHA256 a04a599b3d10b8d8a681cef932d22f2830c05144aa12461fbf822c9a858cae2c
MD5 c7edb19ed87097556230e5f66ab483ac
SHA1 dc66ae642e46ed4351f5da7776fe3ca69283b233
SHA512 4003d0a49f18d2c0d1ec3800482ea3c78e6ac4ebac9dee0f5f19ec8d85e558ef6b61ef3cf30e437f7f4aa3d50f7754997ff5ff3419f82737a35b901621937b7f
TLSH
T12321940B5D932F3B46E3C0C9118B30AEE1EA9158B200289D91EE12F9B77CB75443C2DA
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3208	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6092	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\patch\readme.md
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3208

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads