247abe6e07a5c3a1ddb06ceae19d07d882e81a817ecd2b837468c04eeeaf21a5

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
build/configs/wat.cfg
Size 8KB
Sample260826-add3msbc33
SHA256 247abe6e07a5c3a1ddb06ceae19d07d882e81a817ecd2b837468c04eeeaf21a5
MD5 6be9e25625936b883256152d1808f268
SHA1 bc7ba8ebf366afcf91874bd3dbc32db105290a05
SHA512 8faefccb4fa661556ca5d32de58d849262008d5db0d6204eb72b5d7417e0f99d1b13312f7147c117acee5d83cbe98054f7cc81306d54bc3b37ea6dd2d08c83f8
SSDEEP 192:TgMSmFTlrihTPQk/JTCDISrejLrOTvVriC9Absv8ytUBCgMf5K4qRETRq7kJg/TR:jSuzTAGeCzf5K4qRETRq7kJg/TVy1MMW
TLSH
T10302EE21D790A4DF45BBA9BD81BCFE0C46F407D5292A7B23B69CC02D2E87642748F41C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2432	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4948	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\build\configs\wat.cfg
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2432

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads