d2225915824e34df47758bb1b4ddf0ee853a910a4c724d05954da9c29532e923

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 22:25

Target
serum2.lic
Size 427B
Sample260608-2cclzagv5p
SHA256 d2225915824e34df47758bb1b4ddf0ee853a910a4c724d05954da9c29532e923
MD5 25fb01a25546ed26ceb5c5a5be2bd59f
SHA1 f997701b0139493dd169e238066e5366f90d031b
SHA512 2a83dc5e7adf4049dc8c6bbe75440699917a5f7cde2b9e9669a5f90f4cf470f5ad13e68b063f943a79edd76930bd45016a30f45f4679cbd590a2bfbab1d7af61
TLSH
T197E0232FB4ADC3A04CCC52551A31515D525C8C29FA609C9CA4CE3A55936F1406054051
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2800	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\serum2.lic
1⤵
- Modifies registry class
PID:3372

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact