020706760674224ad7cdb2cdc0f19353c0c1c14698c40c5471468f0958850ba4

Analysis

max time kernel
154s
max time network
244s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.data
Size 512B
Sample260913-wtawtabn81
SHA256 020706760674224ad7cdb2cdc0f19353c0c1c14698c40c5471468f0958850ba4
MD5 6441542fb2afaa7d2c49c9878808b86f
SHA1 5937c7c41f86a1085fe6ad12ee5e5c516db900ed
SHA512 ca92865f7d67f2d9f209533d4000941fd50878a24505b54b9a40c47a8bdab7f03c130707e6c6738566a0fc3b669bebc7c6d11d9a7feac7f06944373d238af85d
TLSH
T12AF09B979F16640DE645CC771751008D331D6E133400139A50D338464539B31DB15C42
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3496	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2644	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\.data
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3496

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads