0273b6a6b9e20e6ce54c5aee70164028e0395063b2b7d39060a40b6495543dbf

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/05/2026, 23:48

Target
resources/jvm/conf/management/jmxremote.password.template
Size 5KB
Sample260515-3tr9esg16w
SHA256 0273b6a6b9e20e6ce54c5aee70164028e0395063b2b7d39060a40b6495543dbf
MD5 ad773cfd53efe03e662f1cf23561f725
SHA1 3bad5b040b6d7117df4c40609ea0f8074339ee47
SHA512 e6794168ba80a8ff733d8c1771930ae8c8fc33030e5e9ca02700f326c88a2f68ff09bc734bfd1e492ef15705b288c7918ce1f3f7174742dee6a62dfe086abd65
SSDEEP 96:MdJb7RT9iQj/y3LNNWoT2Wjb3LpjtzIVSnQDeJuV9uiS2T4Z:059ipz1nlZzIVSnQDeJqpSSO
TLSH
T151C1F0126FC52B620B91E354134EA5E5F718916F6E7B0210266CCA2C332BD6641EE8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3444	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\resources\jvm\conf\management\jmxremote.password.template
1⤵
- Modifies registry class
PID:4212

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact