3a9caf3c9af2e550a3d7252a8eaa3e2019a1e4089af411b70885908b598bd206

Analysis

max time kernel
898s
max time network
451s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/06/2026, 11:14

Target
EXO AI SOURCE CODE V0.85/Flash_RP/RP2040_data/2040.ino.uf2
Size 241KB
Sample260623-ncakqact61
SHA256 3a9caf3c9af2e550a3d7252a8eaa3e2019a1e4089af411b70885908b598bd206
MD5 c4148705e292adf64da0f3bed317af6c
SHA1 b87d0f97e30e426e81aeb353a715423761ece5fb
SHA512 21cf9126c1ff95ddbbbc8c60f37d98c80f013c21e08ec8b20a9bf63a7f1653d40186873cfaa76a4c92278944978ed2c1bf68efc462ea4f1f8e34724d4e794926
SSDEEP 3072:5vRHTylEp3IUcu8sqD8IuGhZ0zf4dc8rC3oc:5vouIUd8sqDvuGhZWA0oc
TLSH
T1153439E7BCF11672CC29727E411A6FA67364D14EE1F8422A145A4ABF934823DCF76B01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6108	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\EXO AI SOURCE CODE V0.85\Flash_RP\RP2040_data\2040.ino.uf2"
1⤵
- Modifies registry class
PID:3528

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact