25b534dcb8b6d54f6705f74ff81f156be45ff3b6c0020f930785d65fbb558dbc

Analysis

max time kernel
298s
max time network
329s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
30/10/2026, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
In Stars and Time/www/lib/greenworks-linux64.node
Size 639KB
Sample261030-xcap6aev8x
SHA256 25b534dcb8b6d54f6705f74ff81f156be45ff3b6c0020f930785d65fbb558dbc
MD5 420012d2287b2e7ed4efd7b72ee5fc96
SHA1 d9d1257b76198fafb187c2eb2fc5c9c72e890517
SHA512 d73bbe4955a2de01e840ff5b31877e686f65a327469413c631123e50891fd8c83b7e328ba872156a51d8f867f3488429641b41fd4812e5d7efc806a5630883db
SSDEEP 12288:bhAdV51qNj3f4S2qQTaRL1OoQIRw33B9:bhAdV51qNLf4S2525anr
TLSH
T125D44B3BB5525874D0D5993016EBC692823474F2833A3A6E15DCCB3A3DD2B843B1E78B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4980	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4095433250-3121633380-635025574-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4095433250-3121633380-635025574-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4860	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\In Stars and Time\www\lib\greenworks-linux64.node"
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4980

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads