81268dbf25b42f1fe52c13656c68e5c6ce6cdd3b39ac2aa09d2ad4ca3f9a242b

Analysis

max time kernel
898s
max time network
599s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PatchSupre/radare2-6.2.0-w64/include/libr/r_util/r_graph_drawable.h
Size 1KB
Sample260910-ry5vjavdrb
SHA256 81268dbf25b42f1fe52c13656c68e5c6ce6cdd3b39ac2aa09d2ad4ca3f9a242b
MD5 bf7833cbedccdb904d0069bc47c2c17d
SHA1 fc85b5781a343342e0384d95d6a0fd6056f8ce2c
SHA512 a69bcd10239a4a70cf5165d6c20a7b5157ed37ee3f557e3d8116f5d32d1e9bc319d8818c7fd8f307e5dc8928ebed4251afe09e530de4865f27cfdde6960323c4
TLSH
T115314535D68EA023693D4260622BA491D5ACF1987313F3ECF578F4AC6D011808527EE4
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1556	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5112	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PatchSupre\radare2-6.2.0-w64\include\libr\r_util\r_graph_drawable.h
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:1556

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads