8028eec2a6dbb69b2322a4a0e9be7cf5de7e571ecda14b78835bfb68fd7de57d

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 14:55

Target
TheUncensoredLibrary/advancements/4bdcbbcc-4cdc-4a0b-8090-4c0e82bf4eac.json
Size 5KB
Sample260608-sakecsfs6q
SHA256 8028eec2a6dbb69b2322a4a0e9be7cf5de7e571ecda14b78835bfb68fd7de57d
MD5 c46cdd22c4f9a3c558f214e94abe7443
SHA1 55652e0b470f23c4eb981ff1e7e4555991a4047b
SHA512 fc45293985a704361bdea3d6293f1d63dbffd7db383a99fd600eae51b9a5c4ccb8c0d333b726fef636c62d5eda2a508e610114836dd17434c3c1b3d7cd98d714
SSDEEP 96:BzGXqR2Gj4VGEqRQ0eK96GxqRsGXGIGAsPGQkcqRznGGGSsKqRoGZsikcG2qR7qw:Lz+RsIU+ReY/
TLSH
T1F3B11C04C9F7296A748550A7CC3E0540F530A55BE96E1CFCB79D468C6FCC61E9E2AAF0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3188	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TheUncensoredLibrary\advancements\4bdcbbcc-4cdc-4a0b-8090-4c0e82bf4eac.json
1⤵
- Modifies registry class
PID:4896

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact