1aea43797607fe7f702b72caf56a9ecb61c0a7b60f43fa02213957f5ac1f03ef

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 15:48

Target
ruin macro (1).ahk
Size 21KB
Sample260623-s8vmzsd19v
SHA256 1aea43797607fe7f702b72caf56a9ecb61c0a7b60f43fa02213957f5ac1f03ef
MD5 fefdaba7ce28e31986a8305d18d75304
SHA1 c6660b17454de79e64c29f39166732d1d033e909
SHA512 9cde834abbd0359e38768455258324caac7f3134611c7a8e0d19bab6acb97a344edfc25c34406bb5f872685f45a84c17f5e9ab8dd60d608fb9f2ce2e1da95338
SSDEEP 384:QFe2v/i0nwqmtyx+Ggr3XW6hyE9hTtcRczAyafAowf:Byx+G0nWMhTIAowf
TLSH
T1F4A25467B7173A64973CC439F9528D06EA26253B402788733A5F2FB87FF936841A4D42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5172	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ruin macro (1).ahk"
1⤵
- Modifies registry class
PID:1880

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact