51e9e0c568195b905c680b8269d9576dfc730484af48c22d6d933379ed912dde

Analysis

max time kernel
898s
max time network
434s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/09/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
browser/resources/app.asar.unpacked/node_modules/bufferutil/build/Release/obj/bufferutil/bufferutil.tlog/link.secondary.1.tlog
Size 651B
Sample260907-ec7qsaee87
SHA256 51e9e0c568195b905c680b8269d9576dfc730484af48c22d6d933379ed912dde
MD5 1edafd4107acf8409417b2bba0364168
SHA1 fc5f334dac0be94b81fd323e75a5861228acc0cf
SHA512 e88d81420955940b79fbc0a7bd684840662d6e83732755886c73dc3327584d293b7e0d12291145f18ba20e1e0e72ccc6e2a45b4c521f33f1e2d9b32005fdacd7
TLSH
T193F09EF579380F329B497007E4634D08F6B6765CD0AD1818D24C4BF30DF204D8191DEA
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2000	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3784	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\browser\resources\app.asar.unpacked\node_modules\bufferutil\build\Release\obj\bufferutil\bufferutil.tlog\link.secondary.1.tlog
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2000

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads