d114831d1f08cfe56f610c2f19e8bdf50b33458fe0c9f131650d95dfbb23af1f

Analysis

user interaction
yes
max time kernel
106s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 15:00

Target
2CF5C2CB23324B9C7C61BB054A52CAE80345F8AF.torrent
Size 74KB
Sample260425-sdq2bab14s
SHA256 d114831d1f08cfe56f610c2f19e8bdf50b33458fe0c9f131650d95dfbb23af1f
MD5 cfa55324c8f0076ff766bcda0a70ea97
SHA1 78df831d614c49de00daa9de27a4c70013eb2cd0
SHA512 7889e630149c31bba07dad68ed07cfd853fbd55fc1cfa77f2aead31756b602f4742a345a1a98f8dd447e7eeb1f64c2f23168469b33e10f7898ed8261fee57458
SSDEEP 1536:C/awjMExIbYiqj0ZJwckOmuCZeOP9HdqMXaFX65rwiAPL:6dj0HwfpVP9Hd3XYj
TLSH
T1A673E1CC82E78B003037B12B74D622A39E1DE0DA2E0DF849EB6D5F5166BD1C9B691247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3768	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2CF5C2CB23324B9C7C61BB054A52CAE80345F8AF.torrent
1⤵
- Modifies registry class
PID:1020

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact