76677f77b1317663329fc71665f47506b954e6439d1e139ca2ec96866c1c7a62

Analysis

max time kernel
898s
max time network
457s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 16:19

Target
autopsy/src/engine/model.cpp
Size 570B
Sample260529-tsv49agy6s
SHA256 76677f77b1317663329fc71665f47506b954e6439d1e139ca2ec96866c1c7a62
MD5 00d5e81190ac3817b45e517c98e89073
SHA1 2df42ca72287ff2ea51060950b11b849efe79c44
SHA512 1a68a64f8366fcd1ac35a949c38db02b3831bf64455a05bd77420f4a043704216e0693df33aa6fbcaf45150e8c78a88aa46bfba854f9e059ad4589cf7c4f594a
TLSH
T17FF0361BF5F7AC4FD21B839423FE1444E8B4F8A651ED85F2224E400A72791DEEAD2864
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2416	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\autopsy\src\engine\model.cpp
1⤵
- Modifies registry class
PID:2012

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact