0f7cb17ee63361b5cb0c464cf8c2d7d48e625e5fdf3ad8cb78119b6d9ad9476c

Analysis

max time kernel
898s
max time network
409s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 15:18

Target
graphviz-14.1.5/doc/infosrc/mktapers.sh
Size 727B
Sample260528-splwqscy6p
SHA256 0f7cb17ee63361b5cb0c464cf8c2d7d48e625e5fdf3ad8cb78119b6d9ad9476c
MD5 e6115fa1436c00e11a92d9dc882e6984
SHA1 35f0fce76e76285e0030c9df378671ba833fb289
SHA512 d5998742c9fbcdf5333543d70a30a24a98182dbcc52f315d9b7bc94cf18b612519d0f67b6627bfda779e06b592aa63da3b2bdf75be8cc4bf331fce9d722c7ca6
TLSH
T1E8017B41B18B717E0105C4602A9A1EEEB131193F42819CB8B4AFD5381B21C6995FBB8E
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2564	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\graphviz-14.1.5\doc\infosrc\mktapers.sh
1⤵
- Modifies registry class
PID:4504

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact