b69736072661a9c9da5849533db15d534714f040299a939021fd331ca8622921

Analysis

user interaction
yes
max time kernel
898s
max time network
425s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Aimware/binfuser-strings.bin
Size 56KB
Sample260925-2v9dnaydmf
SHA256 b69736072661a9c9da5849533db15d534714f040299a939021fd331ca8622921
MD5 44ec8435242cf6bf7691494726d87d32
SHA1 b50258e92ba5de2f2fe5d11e6c4c1a44340e1bab
SHA512 7fd95f9f4e4799a331cb5c7aaf36c2c22f3f6cb40c8ea0c05053f05672d681715e49f4a7cd681858bc2bb78e2c8c9f188c57fc4ffd50fc52895515680c295881
SSDEEP 1536:HPMtc8SBLqk1/CfUzu3an9mNopwZr2PM+:Hic8SBLP1/jum9mNopDE+
TLSH
T15143AFE3335065A1D4E109FEA1D09A07BBB0A2F88766A150DCD9E2DD0099CF5173FA9E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4084	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1572	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Aimware\binfuser-strings.bin
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads