364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab

Resubmissions

02/11/2026, 09:49

261102-ltnskaef933

28/10/2026, 04:41

261028-fa9m2aat7l7

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
graphics-hook_config.bin
Size 829KB
Sample261102-ltnskaef93
SHA256 364251838edfcf5ef1107fa692da3c5bd9a540482449f645992830134bf807ab
MD5 71067a6f7a396d3e6e51216abff279fb
SHA1 392173d6c8068265ca14519374ab0f0687c4ac1d
SHA512 ab6e9aca215d7f33de3df6767d23b9faa1aef8ed3a19edfb81b12b018611b7bf74f936a496239fd18ffec802b027170ea811b05a5fea7460a0edab61d82664ce
SSDEEP 24576:u129A0UYy3z8r7VzaH9V6t8FDvoDwO/8R82d+K:u1TZPD8r7YdxvRO/M828K
TLSH
T13205239247CF4E06956CD75550EE6481BAA12135345ED4E3B18B5C72B02E22CEB873FF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1036	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2684	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\graphics-hook_config.bin
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:1036

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads