0b7c07744e4d8da1c07ab25161fe916f3a94e532fc9bd05a5b8f9ba587651f38

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
build/configs/hood_rivals.cfg
Size 8KB
Sample260826-add3msbc33
SHA256 0b7c07744e4d8da1c07ab25161fe916f3a94e532fc9bd05a5b8f9ba587651f38
MD5 e5aee4fd4759eb51923e11f8a1ddc33c
SHA1 65ba5a49a3bc91a3c23fbada0bff676d1068861b
SHA512 be46a3c0810faab01fb3eda59b43796f23f23b4506c29bb9869d18d1ee358a7017e35780f2a51339107461f93143ac7c71a18c33f168eaa5683b77c3d68a9661
SSDEEP 192:YgMShFT4PihyPQk/J8vCDISrejJrOTvVofC9Absv8ytPCgMf5K4qRETRq7kJg/TR:IS4JJAGBCzf5K4qRETRq7kJg/TVy1MMW
TLSH
T18902EE31D790A4DB45BBA9BD81BCFE0C46F407D5292A7B23B69CC02D2E87646748F41C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1256	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3172	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\build\configs\hood_rivals.cfg
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:1256

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads