0b4fb05d025dd17418bc89cdb620695c4999747c42eb4497d51c488a00e18ff7

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payload_file.sh
Size 719B
Sample261017-m3htcaet4w
SHA256 0b4fb05d025dd17418bc89cdb620695c4999747c42eb4497d51c488a00e18ff7
MD5 3312e1452dd4f6668c772e9a8f0dea82
SHA1 8df0254b57c1ed15d4f81e64321ecd902cc7e3ed
SHA512 23c149def737a9a6426dee9c1ba8dc412945ccae3fb6ae6f4271ae51bdc5c5d819626d0c8bfb577716e043e57631ce56a9903e5f594e796ec56b94b07102d500
TLSH
T15601F7DF4A80742FB7916AA8369F34C8D62683B1E9E18D88D899DC909FE1A04F048F15
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3704	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2324	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\payload_file.sh
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3704

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads