85ed976e3cd73f81cf51f65d4a2e9d1bc43cff3a29ca61d5b9a7cbf72f21ac4f

Analysis

max time kernel
298s
max time network
297s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/07/2026, 16:03

Target
UI/resources/app/extensions/windhawk/webview/locales/da/translation.json
Size 12KB
Sample260702-tht47set7n
SHA256 85ed976e3cd73f81cf51f65d4a2e9d1bc43cff3a29ca61d5b9a7cbf72f21ac4f
MD5 7736e0d8495f562be552a0eafff87683
SHA1 c8b865952591cd5f76c30c422966b5d3e69a8cce
SHA512 d98f191b8cd9198198b84686d5ec60d3991e1b15fae56ea4ed2369fee03a872b6d0913d1d6f08d8670e32e65174bbe1c034e077e8d06ad1fa0ed60496d1f9d80
SSDEEP 192:SAxPvllQZSI6byfsHbFfs5hUq4TnILBf+EvvsA7U75XC30D1FXyJkN:S4lQZSVWf4fXIBsA7CAql
TLSH
T1E3426283CD754D6F01F7036668624A4AF669236F5340090BB9FCD09C0FB387197ABA6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4728	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\UI\resources\app\extensions\windhawk\webview\locales\da\translation.json
1⤵
- Modifies registry class
PID:3676

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact