8cc5213b35bbc0b6ef13a98c617b814dde9d5f92637e2a9e09088dfafa31fb8f

Analysis

max time kernel
898s
max time network
489s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/06/2026, 11:14

Target
EXO AI SOURCE CODE V0.85/Exoai.py
Size 47KB
Sample260623-ncakqact61
SHA256 8cc5213b35bbc0b6ef13a98c617b814dde9d5f92637e2a9e09088dfafa31fb8f
MD5 2b3aaeee153957e2a687d1f59dc43ccb
SHA1 894968eaaf4fba1516aea37729a981bc600a9f84
SHA512 7b8a808f031cdd731840348baa6d509e42f3b51ddd90c681152b7a56884dafca198f22c50888f9cec768d0d898223fba454d0b886900ab1fe5363330ac878d9d
SSDEEP 384:nKM/DoTZSCuZOGHps5/mjQP8OlqEF0TlHoWjXYwxesQfHlq2j+VQommI0P5:nKMboTZS0DBqEF0Uvlq2CGLyP5
TLSH
T1792376362C0958019177DB1B95A78A46DD4512C38B325E32BB7CD2688FB10C1D9E9FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4196	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\EXO AI SOURCE CODE V0.85\Exoai.py"
1⤵
- Modifies registry class
PID:1500

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact