6cfdf08be09f32ca298e2d5bd4a359ee2b275765c09b56d514624bf831eafb91

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 12:22

Target
amazoncorretto.rsa.pub
Size 451B
Sample260421-pj2s8aet7n
SHA256 6cfdf08be09f32ca298e2d5bd4a359ee2b275765c09b56d514624bf831eafb91
MD5 6c7fb40b9b580291c0e8315022352947
SHA1 60f0b4f18eb50d2665a45289ec7f9f67d0ae3ade
SHA512 7ed0a570d8ff7cc6c2ffa5c1a39057035d572ad2dfdb7ee635d85ff6a4fb58974e6566b80c30f4ecec399f642eb7f92cc75101cfda6d6bccbc5f4423a0de39dd
TLSH
T1FDF0DC5A1FB358E940B8C35ABD9391CAD1A833DB127064590A58711B6891604B97D036
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3956	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\amazoncorretto.rsa.pub
1⤵
- Modifies registry class
PID:1964

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact