ed93c46bce7972c620a20d5aaee781a66e894a98648b1b19ab9c1f095f4789ee

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 03:38

Target
HwProfiles/Gigabyte Generic for AMD X570 Series.hwp
Size 757B
Sample260511-d65b3say41
SHA256 ed93c46bce7972c620a20d5aaee781a66e894a98648b1b19ab9c1f095f4789ee
MD5 0c4d4d3fd2daa626d5ef8b5c1d798105
SHA1 c33e74517c048b174e65a62abde4aabe86a1e638
SHA512 58708ce1c524776a4fd2583bad244a7f61deaafffd448ad24ce6ff8e71f0ec29917a79134b74ca260031ad38038281e16aceadfd38a6a1dfac136f5a9c8febd1
TLSH
T1950162AE218D6A5834EF0F94D343D340B8DCCD8D6757B4CF1E69430E9208A67963AAC2
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
820	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\HwProfiles\Gigabyte Generic for AMD X570 Series.hwp"
1⤵
- Modifies registry class
PID:3520

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact