8c3326368f7fb71a201c1e4cf8da4d234eafd38ad25bbb6243a52862a6371490

Analysis

max time kernel
899s
max time network
354s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
820151246/gfx/FX/pdxmesh.shader
Size 18KB
Sample260912-pc3f6sbd65
SHA256 8c3326368f7fb71a201c1e4cf8da4d234eafd38ad25bbb6243a52862a6371490
MD5 713e13dbf69f92a89dbab5f7f326f1b9
SHA1 555bf428c7d6d5d398b028191d491ae3ff5de7f1
SHA512 d1975f4753ae1491ee6d0a4d4873fb7d9b29eac674ff6da62f3456ce1abff821746f554a08b989b5e5ecddc6aa6ad412bbb791e1b06676b8123c27c8a333c624
SSDEEP 192:bW9YEWmY0WPYQWdphWCYxWYYcZpBBl+0F0r0yM1al+0FM7nbl+MWKTan8w52b8mb:i9YTmYDPYXdpcCYsYYczSY+qyC1ptKi5
TLSH
T12482329E935C1C0E1DA7A09F8CA95A03E4AD91BA5CD54FCA7C8D0E2439D303E984EFD4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3964	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1396	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\820151246\gfx\FX\pdxmesh.shader
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3964

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4208

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads