30eb9c29cc16f358bad4252cc5e577a7155de2dab9b95bac2a3fd85b90b57160

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Afterschool.Tag.v1.0.1/Afterschool Tag v1.0.1/data.win
Size 26.1MB
Sample261023-e2ascaby7n
SHA256 30eb9c29cc16f358bad4252cc5e577a7155de2dab9b95bac2a3fd85b90b57160
MD5 1564bf67b280273c00ac83c507f9057e
SHA1 606f0b7ff39d15885ed8b6343a853ab8c81cb181
SHA512 a112024a98cd08fe71420e701971050bdd937a71fef6d63d9e48ce0528c5f655994c5b5ca61213a5d0dcdd40746c9c1d0305fc4f7596d1cecda8d9c73a8eac4c
SSDEEP 786432:v5yo0ZBUOV4QTmt4d5yuBF5JE7s4ZBnZ/DfQ:vQXZBUTQT4yfEo47NfQ
TLSH
T14157E091F643D680C462A9364E56C9C01B72BE5DAF41573B3088BF2F6AB3710DE2D3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2540	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4260	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Afterschool.Tag.v1.0.1\Afterschool Tag v1.0.1\data.win"
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2540

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads