8168f64860717712a9d0a00da876e84f03c34834b3a8e0e1dfa783a9c29f7235

Analysis

max time kernel
148s
max time network
43s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$APPDATA/Portmaster/intel/notifications.yaml
Size 6KB
Sample261107-mvtkwabs3x
SHA256 8168f64860717712a9d0a00da876e84f03c34834b3a8e0e1dfa783a9c29f7235
MD5 9f328dac539016f79a513f5b71517c29
SHA1 b6b5d1a04eb8b6d0d88819e818d448b159a03381
SHA512 0b3697a9b34ec142a9427e66c3f2e9f07aba92381c5bafc1111cc055f6e330f1a96ce08d13f4f9c5b8ca3dd3f3d7b1a37b9cb535ceec56e972a988d2f610b7d5
SSDEEP 96:cUwvh6VR0ymBfRpXVNrnr/dqOZhXM4xKDqrFnn0ZEtn3FNT6RA+niFjRAEniFWct:cUI6H0ymbJrRqwrKDKAovK2vct
TLSH
T1C5D185D7B348A67ECD8A109BA4C251A18625F9EF937098BC70DD511C2F0B77081AFBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2904	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1128	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$APPDATA\Portmaster\intel\notifications.yaml
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2904

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads