cadeba05a886604c0a7061bc59785eaa6344c09098afdcd671e356314e7912a5

Analysis

max time kernel
899s
max time network
480s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 08:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
replay_mimic_cpp/test_breakdown.py
Size 969B
Sample260908-krdddaweph
SHA256 cadeba05a886604c0a7061bc59785eaa6344c09098afdcd671e356314e7912a5
MD5 8fa1bd596ff75a384b0c5e71fd7ba414
SHA1 174a34b8018f0a4f99d4ce0572a2e907b601678a
SHA512 f7d84e138e1d13e5743a2e3c87f7ecedff9b82655dd00d4c15f9d404840dca9d51d9e8910b6d1d44a5e911dc8dadb48d9830c6124a62a159ccfb440ed3d16ffe
TLSH
T1BC11EDAF28733231C5694CE0FE545A29738B6CD3E3217831FED2633E4A459C69211C2C
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5716	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3660	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\replay_mimic_cpp\test_breakdown.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:5716

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2960

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads