17b6582ad9352fb2272b9696a1b18fcc7b980a83e926a06b5b8661743d7fa871

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 18:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RC7/obj/project.assets.json
Size 4KB
Sample261024-w5nl2swtfx
SHA256 17b6582ad9352fb2272b9696a1b18fcc7b980a83e926a06b5b8661743d7fa871
MD5 5d4b289a18b05e1fd36e445fc4c8152a
SHA1 bf015077e57b100d40b71689631f22eee90387c5
SHA512 a0cf49d2514ba6ecb5d49948fc2abb5f9c3c8888ed81e88e97b877b906787f17a86db8bd9beb54362f189bc67633b9475286268f151ad2c9d9e17cbe2e2a3322
SSDEEP 96:w/xdo+YdQThBg2G3+wrM0NqxEVvUNQcjyMNm:wJddThMBQxFzm
TLSH
T16F914427C9048DB719B93B78957E5B46F612036B22402C8F36BC16CC4FB1F26A4A5F65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4496	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2172	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RC7\obj\project.assets.json
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4496

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads