fa0e1ceca570895b61a0a6bf4e7ff73d94d2aff91ffd799130ae23fb7e670bea

Analysis

max time kernel
149s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Common/Media/4J_strings.resx
Size 5KB
Sample261002-1efwqstdmg
SHA256 fa0e1ceca570895b61a0a6bf4e7ff73d94d2aff91ffd799130ae23fb7e670bea
MD5 cb0c117fe97d96d41b11b4af1b557b56
SHA1 617ae200bf4edbda418f11df5a04a46ac6cbe199
SHA512 d9cdee259a0f35a6b4eb7cd6de8b78a9a6071f9936ca167971e5def9aff65d7973eeeeafd9228937db946a71c7028bc1858989c677a5a5fdfabcf0077e4a3f74
SSDEEP 96:OoixXiWf1iWLiW7iWBiW7eZiW6OiWK1ZiWEiWziWTiWjTpZiWztiWpiWWVZiWmZc:McJjrhcNfxmAJ7BM4ro+b38Zg+9AZPE2
TLSH
T1ECC1FC8EF5C5ED952979953CB92165D2D6A1F02722C82BE230C8304F6F9EDC876E3D81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4888	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4784	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Common\Media\4J_strings.resx
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4888

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads