f5186f9643e3eac02a888b65ae9b1e354add39f717dfc8843c57163fd81d0c05

Analysis

max time kernel
441s
max time network
442s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
03/05/2025, 04:49

Target
1234/myfunny.c
Size 5KB
Sample250503-ff72dsem5t
SHA256 5bcd80c1acfe2ab24191bdf35f8a8be01a5da7f45e4c6da373af51a8db5c25b0
MD5 4e6768918452e6179d1baf76d83d9eb2
SHA1 5f234fa47e13d97e8a825b4be979e3c4f075bffd
SHA512 08f8c3625384cde8b6806922d665583a34ae3318ec0a9bcfa0767f7a531d974aef2cbe0c30e22ec7fa7a7a10860c121cce81a53017315f5bdf7d19c53ed37d12
SSDEEP 96:6DrniQwPMFo74DtoQAdVWFnQnNihv++pNEf4yxKMYQ/t8D36A9fdZ/vV1PkM0gGl:uiQwPMo74DiQAdVwnQnNi0oCAyoMYQ/p
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1245416451-815278583-4285364870-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1245416451-815278583-4285364870-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5968	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\1234\myfunny.c
1⤵
- Modifies registry class
PID:1056

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact