f5c25def746e72e744e8039054007cd0bad8c73108cdbedb568632b7b100be2e

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260130-uk
resource tags

arch:x64arch:x86image:win10v2004-20260130-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
25/04/2026, 17:14

Target
plugins/basic_games/games/game_assettocorsa.py
Size 510B
Sample260425-vsd2eaew9v
SHA256 f5c25def746e72e744e8039054007cd0bad8c73108cdbedb568632b7b100be2e
MD5 50b27ebb0b53f3f27d5e8d1e77cc91a3
SHA1 4fdbfb353e7273836ac822cbdd6d6730fc740db6
SHA512 5af74b8fb592e2b01308fea4447a5f291a4dfa6f259c7544f6bd3b9462713e607a976757be9aea29a88203782703f4707eab968d7fc0fb28129fa121080afdd7
TLSH
T1FAF05230A90BAA95B970AF700038B34BFA7813F34A025B05B59C011F7F38AA3C18810C
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4796	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\plugins\basic_games\games\game_assettocorsa.py
1⤵
- Modifies registry class
PID:4252

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact