881320dc29bcb00de1b1b3aadd86753a49bee91db78adf1a4d56a6885caee8e4

Analysis

max time kernel
150s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TRISTA-38228-260929.heic
Size 3.0MB
Sample260929-tp87psyt9n
SHA256 881320dc29bcb00de1b1b3aadd86753a49bee91db78adf1a4d56a6885caee8e4
MD5 e75aaa4ecf4b7105f1264b75820bc241
SHA1 fc5a442afba0c18aa1feda15ddc3ce568e2843d8
SHA512 accb2cb08465ded61ecc26c5f47fce9c640574137e685ba4878c00076efe7979e2f5991c85166e6e8d7d0ed7f3d0fbcf0c8aba05a805e670925f7c164f03cd26
SSDEEP 1536:IL9zIrMzMJLFkFzEdzNMzjKKzkeoWJLblznMyMzfzOwzkhIXiI0Fy5CE9EdRzAI3:jO0IJ0q
TLSH
T160E58EA753D5C410D8AF3A70895DB7ED022A8CC59E6B8CC39D72F1D6E275730A90A39C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4680	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4068	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TRISTA-38228-260929.heic
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4680

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads