66feda986e3da240479c53401c2a8f1114748098e151c06890c75feade128ed7

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MotiveWave-main/README.md
Size 8KB
Sample261014-rxg23set4v
SHA256 66feda986e3da240479c53401c2a8f1114748098e151c06890c75feade128ed7
MD5 7cb56739179d60c59825946d9564c82b
SHA1 aafaa6356a8d5b14ad3c61cec16f335190744466
SHA512 dcc39805106a5ab73c64dd29a22bdae8ca29cbeb9d16e5db5599d9142de406b65a0faf60bb3b6105a65655d651303220755f2f796064cf4470068c259f361cbe
SSDEEP 192:3PQPJ5MyWlSaiYjbe0yPyi8SDQmWiYkzioVZWMx29YlaInApa:3IYlSaiYjbetai8cQdiYkzioV0Mx2WYW
TLSH
T14402D7B77AD693F21E2252C15F8E90C66E13C09E532AD739285D2098330F62C52EB1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3864	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4760	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MotiveWave-main\README.md
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3864

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads