a86d4ca2038d0978d8b539224e9d60ff55b475fee2e6d113ee24c8a60852c70b

Analysis

max time kernel
298s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 23:34

Target
RefreshTokenApp/runtime/conf/security/java.security
Size 72KB
Sample260629-3kn6eahy5x
SHA256 a86d4ca2038d0978d8b539224e9d60ff55b475fee2e6d113ee24c8a60852c70b
MD5 25fcce9d59b4dd156d532ca47a742597
SHA1 eab689f234879082366530e25737fad0f2983010
SHA512 efa421a738ae79056fb68dbda14aade554f984b110fcc88f4e1144eab3699900d981f3875f6497a731b1a58d1bf0c3bbc6e589302f897608a9b50e6629886267
SSDEEP 1536:rQMy8R78MRjJPFp5/LTNHu1UoQ2k/gl0ug6YilNndOcA2ZIYy60:J8MfPFD/LTNO1UoQDHiDndOcKp
TLSH
T12673D522BB897B7206F211A363AEF1D9F76DA12A22325154748D420C7326F71C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6780	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RefreshTokenApp\runtime\conf\security\java.security
1⤵
- Modifies registry class
PID:6132

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact