7bd6a69d62cfc86a911401c13e8d09e95b847277dbc6ae3074bf53944c1c19fd

Analysis

max time kernel
298s
max time network
296s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/07/2026, 16:03

Target
UI/resources/app/extensions/windhawk/webview/locales/ar/translation.json
Size 16KB
Sample260702-tht47set7n
SHA256 7bd6a69d62cfc86a911401c13e8d09e95b847277dbc6ae3074bf53944c1c19fd
MD5 4a739413a0238c4df146965e596c47bd
SHA1 a5f4135580f51f25aeba674cd871aad2f292e5e4
SHA512 b7490b150f6258e1b5fd5dab8fb12ba9cef2353993c70199e593c793f9542402b0175c55f0c707a43f93bb64bf87684d0596160734a4d217cf14b028f84aee26
SSDEEP 192:KIlf/oOjVjRv6YBQC6YBBcmLZ0y6Vpx32IAupLV+EUjILcWoE50oOHlPwmN0Kn2K:KoXpRjM7YN6EIrpo9m+DZn3U4n
TLSH
T182725C9289258CB206B59B0DD0E62668F8719F3B9246FC23387F160C5FB7C63D64A774
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4528	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\UI\resources\app\extensions\windhawk\webview\locales\ar\translation.json
1⤵
- Modifies registry class
PID:5004

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact