bc07868a7bac423c921896315cee49ec10059b0cd93bef616b3432ed965959ee

Analysis

max time kernel
149s
max time network
105s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/05/2026, 19:43

Target
triggerbot/tb.ahk
Size 1KB
Sample260516-yfcvcsct8m
SHA256 bc07868a7bac423c921896315cee49ec10059b0cd93bef616b3432ed965959ee
MD5 5ba16631513c81e8678aabf5a6bf21f1
SHA1 d588bc218f3f2e96e5bf3f3b53f222ffc764ccb4
SHA512 4f5e1c97a231e68fb3a8587746d156035e39907a1027a84b3d5e0635f57f8e20dd5aa9fbd7262b64c5c0de77927f8817e82555636e1b0bab15d69b10cae06c13
TLSH
T1694174BC7E52F81D00F7E6B683A3242BE029A03984666C20B71C4D853F4884237DCF36
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
840	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\triggerbot\tb.ahk
1⤵
- Modifies registry class
PID:2656

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact