e53e5feb26371ce2fed77793c390fb6222f0fa4cdf8230efb0a03e9a2cce5aee

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
build/configs/wat22.cfg
Size 8KB
Sample260826-add3msbc33
SHA256 e53e5feb26371ce2fed77793c390fb6222f0fa4cdf8230efb0a03e9a2cce5aee
MD5 af2584efab3d9ff23d2ee3f61caf5d4b
SHA1 ca8279f5fb45398788a4fad889b6487ab94648b5
SHA512 6971fdd4e1be7841ad9d9572d289598f374bdd283c80fe0198d0752c2b452d402f0bed64b68f9659f8585e76e8fc7f3e32883d9434acafee51fb74913ed79aea
SSDEEP 192:sgMSmFT4PihcCPQk/JTCDISrejJrOTvVofC9Absv8ytPCgMf5K4qRETRq7kJg/TR:MSjHJAGBCzf5K4qRETRq7kJg/TVy1MMW
TLSH
T12B02ED21D790A4DF45BBA9BD81BCFE0C46F407D5692A7B23B69CC02D2E87682748F41C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4224	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1268	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\build\configs\wat22.cfg
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4224

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads