Overview
overview
3Static
static
1AutopsyUsermode.zip
windows11-21h2-x64
1autopsy/De...set.js
windows11-21h2-x64
3autopsy/sr...er.cpp
windows11-21h2-x64
3autopsy/sr...iver.h
windows11-21h2-x64
3autopsy/sr...ck.asm
windows11-21h2-x64
3autopsy/sr...or.cpp
windows11-21h2-x64
3autopsy/sr...ra.cpp
windows11-21h2-x64
3autopsy/sr...gine.h
windows11-21h2-x64
3autopsy/sr...an.cpp
windows11-21h2-x64
3autopsy/sr...ce.cpp
windows11-21h2-x64
3autopsy/sr...ht.cpp
windows11-21h2-x64
3autopsy/sr...math.h
windows11-21h2-x64
3autopsy/sr...el.cpp
windows11-21h2-x64
3autopsy/sr...fset.h
windows11-21h2-x64
3autopsy/sr...rt.cpp
windows11-21h2-x64
3autopsy/sr...er.cpp
windows11-21h2-x64
3autopsy/sr...ew.cpp
windows11-21h2-x64
3autopsy/sr...im.cpp
windows11-21h2-x64
3autopsy/sr.../aim.h
windows11-21h2-x64
3autopsy/sr...ll.cpp
windows11-21h2-x64
3autopsy/sr...ball.h
windows11-21h2-x64
3autopsy/sr...che.js
windows11-21h2-x64
3autopsy/sr...ache.h
windows11-21h2-x64
3autopsy/sr...sp.cpp
windows11-21h2-x64
3autopsy/sr.../esp.h
windows11-21h2-x64
3autopsy/sr...sc.cpp
windows11-21h2-x64
3autopsy/sr...misc.h
windows11-21h2-x64
3autopsy/sr...ntom.h
windows11-21h2-x64
3autopsy/sr...ent.js
windows11-21h2-x64
3autopsy/sr...lent.h
windows11-21h2-x64
3autopsy/sr...ck.cpp
windows11-21h2-x64
3autopsy/sr...heck.h
windows11-21h2-x64
3Analysis
- max time kernel
898s - max time network
412s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 16:19
Static task
static1
Behavioral task
behavioral1
Sample
AutopsyUsermode.zip
Resource
win11-20260513-en
Behavioral task
behavioral2
Sample
autopsy/Dependencies/Clipper2Lib/src/clipper.offset.js
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
autopsy/src/driver/driver.cpp
Resource
win11-20260513-en
Behavioral task
behavioral4
Sample
autopsy/src/driver/driver.h
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
autopsy/src/driver/luck.asm
Resource
win11-20260513-en
Behavioral task
behavioral6
Sample
autopsy/src/engine/actor.cpp
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
autopsy/src/engine/camera.cpp
Resource
win11-20260513-en
Behavioral task
behavioral8
Sample
autopsy/src/engine/engine.h
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
autopsy/src/engine/human.cpp
Resource
win11-20260513-en
Behavioral task
behavioral10
Sample
autopsy/src/engine/instance.cpp
Resource
win11-20260513-en
Behavioral task
behavioral11
Sample
autopsy/src/engine/light.cpp
Resource
win11-20260513-en
Behavioral task
behavioral12
Sample
autopsy/src/engine/math.h
Resource
win11-20260513-en
Behavioral task
behavioral13
Sample
autopsy/src/engine/model.cpp
Resource
win11-20260513-en
Behavioral task
behavioral14
Sample
autopsy/src/engine/offset.h
Resource
win11-20260513-en
Behavioral task
behavioral15
Sample
autopsy/src/engine/part.cpp
Resource
win11-20260513-en
Behavioral task
behavioral16
Sample
autopsy/src/engine/render.cpp
Resource
win11-20260513-en
Behavioral task
behavioral17
Sample
autopsy/src/engine/view.cpp
Resource
win11-20260513-en
Behavioral task
behavioral18
Sample
autopsy/src/feature/aim.cpp
Resource
win11-20260513-en
Behavioral task
behavioral19
Sample
autopsy/src/feature/aim.h
Resource
win11-20260513-en
Behavioral task
behavioral20
Sample
autopsy/src/feature/ball.cpp
Resource
win11-20260513-en
Behavioral task
behavioral21
Sample
autopsy/src/feature/ball.h
Resource
win11-20260513-en
Behavioral task
behavioral22
Sample
autopsy/src/feature/cache.js
Resource
win11-20260513-en
Behavioral task
behavioral23
Sample
autopsy/src/feature/cache.h
Resource
win11-20260513-en
Behavioral task
behavioral24
Sample
autopsy/src/feature/esp.cpp
Resource
win11-20260513-en
Behavioral task
behavioral25
Sample
autopsy/src/feature/esp.h
Resource
win11-20260513-en
Behavioral task
behavioral26
Sample
autopsy/src/feature/misc.cpp
Resource
win11-20260513-en
Behavioral task
behavioral27
Sample
autopsy/src/feature/misc.h
Resource
win11-20260513-en
Behavioral task
behavioral28
Sample
autopsy/src/feature/phantom.h
Resource
win11-20260513-en
Behavioral task
behavioral29
Sample
autopsy/src/feature/silent.js
Resource
win11-20260513-en
Behavioral task
behavioral30
Sample
autopsy/src/feature/silent.h
Resource
win11-20260513-en
Behavioral task
behavioral31
Sample
autopsy/src/feature/wallcheck.cpp
Resource
win11-20260513-en
Behavioral task
behavioral32
Sample
autopsy/src/feature/wallcheck.h
Resource
win11-20260513-en
General
- Target autopsy/src/feature/cache.h
- Size 1KB
- Sample260529-tsv49agy6s
- SHA256 a783b1ac360a1fee37a177d4cfde52e363a5381b9dc7bddb49de6923dea6a8fa
- MD5 c1876c8f24c859804c78a08a5da1db65
- SHA1 37fcc3b6f45a76b647089e462665e1c8b8fadc30
- SHA512 c625f5d0dccde205588b3d8352ffa2e23d73bbf2241699648a122160e671bacdf400b45d2b87be0db8f417cfab4316f156c71e82ba90ace464eaa2704866510c
- TLSH T17331B458C3376A041E3A50534B112017D6EF1AE7D781927270AE16CD6F3226BC6DB1BF
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5240 OpenWith.exe