25dc667ed315de9741b41538d6f14551f89eb1e7c4b2fdb88154bc131b63e5e8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/06/2026, 12:19

Target
wsgidav-master/docs/source/conf.py
Size 8KB
Sample260604-phl2daet5z
SHA256 25dc667ed315de9741b41538d6f14551f89eb1e7c4b2fdb88154bc131b63e5e8
MD5 9c9346e3fa9bef88363e22f51462f1df
SHA1 806587bba41218bdff353b6270439e35a0cf8193
SHA512 74e5236233a4d19299870977950e20b85933591d25e8a1372d5a811ec2cb02d44ff733a57ee2268d090bc1c705c389a1a0f1fc9b0f76d5316e3a0a8981e8ce19
SSDEEP 192:Go+CP1fliLRzkS4sbe1mhsuKasMIYHztsPJo1:GoH18L9r4sbe1xaUOsPq
TLSH
T14802A616AD416A330513C157B1DA66A1DF34C3BF3B56351AB4AD40187B3473D02FE6A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4812	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\wsgidav-master\docs\source\conf.py
1⤵
- Modifies registry class
PID:4792

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact