4317b8fd5ecee76c5c0543ef21d04df4f4e46ce8621124966b3849886330ee1b

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/09/2026, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Vapo Webhook Manager_Slayed.exe
Size 147KB
Sample260925-vfdvwa1flc
SHA256 4317b8fd5ecee76c5c0543ef21d04df4f4e46ce8621124966b3849886330ee1b
MD5 067018ee46e53aa154b8562fed1e2108
SHA1 abd5fd06c3af7cadfff9e2d524ba7e3f5419c393
SHA512 402aaa6c3daa3fbc94430eb35fbc8f7a58b2fb670172b88d19fbfc9826bac2f63a0bcb3565bdac4f1f66c074c4cf3c83b3f5b159e0461a94f96545a9aea0cf0f
SSDEEP 3072:12yx5i6/XF6B0e1EhRWiQFuKaLo2TUs8RZ/f0hapbmrskg:12yxvF6V4AiQFSL7x8p+2a
TLSH
T17AE312190DB9CAF2E1AA22FC21D18D50C2B4E7564127EF9F38D4B4DA1CD3BC46B20D86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings	Vapo Webhook Manager_Slayed.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1004	OpenWith.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe
1004	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\Vapo Webhook Manager_Slayed.exe
"C:\Users\Admin\AppData\Local\Temp\Vapo Webhook Manager_Slayed.exe"
1⤵
- Modifies registry class
PID:2872

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Vapo Webhook Manager.py

Path C:\Users\Admin\AppData\Local\Temp\Vapo Webhook Manager.py
Size 13KB
SHA256 75dff9af0b84dff38a69589e62c0d195d5232901e09e75fa202e2ede692d5438
MD5 3c0cfa355bb2072ad589031988368f6d
SHA1 34d4fdd3902f34be2291b406c853706e26e8dc02
SHA512 7af8f014a0dcd041de4707a23d44822b7dba56fcf2b380930c4e012eb16459613a6e196d552be5f10d65219a0e40621ad2b681ff0049d909ff5a58fabf2cc8b5
SSDEEP 192:ihx0fIL1u1CwYLoDHtNhxamqBfPCHj6mvpOIO+OBOROPj0jy7P9OROnOlbgdWZwv:ihfLYhmoDNNhkHCHGmvMT4K5ue
TLSH
T19052A76B5C191C2D8273891FF166743AF61A8E13521A6D13B4FC17142FB8341A2E8FBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2872-0-0x0000000000460000-0x000000000048A000-memory.dmp

Download

memory/2872-1-0x000000001B200000-0x000000001B210000-memory.dmp