7320937da1dd2663e9eb2849e612b7e7aa437d8521d6e62f2fcca39e9743391b

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 03:49

Target
Krasiovskia_AES-Demand_Program/.vscode/settings.json
Size 217B
Sample260602-edd5vsew7m
SHA256 7320937da1dd2663e9eb2849e612b7e7aa437d8521d6e62f2fcca39e9743391b
MD5 a102f83f4ef7b080a72afc9362192bc0
SHA1 cd2e07926e83683772f2b760323345ab0f4bbd31
SHA512 01ad72b75c903c3f233ba4d40bd3922430cbd6a750fdf7318f7648c9e2c2b17777ccf8321ad06cc246913d321f4d1728e7ee82adfcccc9f6fb1c7c41c4a15e22
TLSH
T166D0127BC0344CEAB3B012958475490BF82102BF015278B731BF754C4F336B64822577
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4436	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Krasiovskia_AES-Demand_Program\.vscode\settings.json
1⤵
- Modifies registry class
PID:4044

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact