affbdc2a83b7d656b98cb2f77f6c33e8ce8221919ea1a50d803b19647588f07d

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
-VladMelSM-main/.gitignore
Size 290B
Sample261024-3cbv4ssx3m
SHA256 affbdc2a83b7d656b98cb2f77f6c33e8ce8221919ea1a50d803b19647588f07d
MD5 a21937e4390e853a6476678364b3bf90
SHA1 d43d4e49facfbc2b3401c825fd257abac498be81
SHA512 f34afdf1ab31fa26bd04c104baefab0a2e77403b960db5624f29b6a3de5496b518336761e10f17b8c467d9c8ecf4f4d6ca1d23940e3017c404c9d9afe38223e4
TLSH
T1B8D02B8D449F984D5E7158C733FA7102E45DEF8E6B05D575F16845E5A70002930C3029
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4304	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2676	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\-VladMelSM-main\.gitignore
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4304

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads