6f38e463c6985994cdcf6c788f0fe2c94bbf20d2ea04d9bb650e6194363af335

Analysis

max time kernel
898s
max time network
397s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-es
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-eslocale:es-esos:windows10-ltsc_2021-x64systemwindows
submitted
08/07/2026, 01:41

Target
ProgramWin/Components/app_64.sdat
Size 789KB
Sample260708-b35sbshs2v
SHA256 6f38e463c6985994cdcf6c788f0fe2c94bbf20d2ea04d9bb650e6194363af335
MD5 9f27249bbefd25d84fc17bb704fbb0c1
SHA1 201a4a58b383346454467b63587b41f9a7a2a6bf
SHA512 420e54ff4f39d045e73770e7b057e7decf36aac7fcc2722a26c427b8a1f2e29028051154f5e6e53102fbaa7cd33034c44722f03629016356caed4dee74a98042
SSDEEP 12288:9+sR/ncpzfMEnu7yYQlZc3jHxR9QtYMy3fTD//g5R5r9jn:9+sZnAMEnoE0H9MK3ngJ5
TLSH
T16B05336C371A735F402A7964E3C5E46DF42D9258D3B640E0BE3938CE75CBBA6DE82094
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2644	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ProgramWin\Components\app_64.sdat
1⤵
- Modifies registry class
PID:764

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact