5746705db9f82530b7b0341649e1e77539130f0bd30f2b25b6780217fafe2cc7

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 08:33

Target
Ratchet.and.Clank.Rift.Apart.v3.630.1.0-P2P.torrent
Size 70KB
Sample260714-kgbrsshv6p
SHA256 5746705db9f82530b7b0341649e1e77539130f0bd30f2b25b6780217fafe2cc7
MD5 33c256d0a06f2eb76fb14756d3aa7b84
SHA1 d4d9f8c9a393042c5aef0d4b4516f80db93cb0ae
SHA512 a8c07303a71afcc4f2e1c81523aefa68b419e9cef3732cefa8d1598ad1d49dff30072c8e59536c6d3d4cb3c74366294157299c0698d7576e4c0210f5d3e0b829
SSDEEP 1536:AVmcqGeM2fz3ki2wTw1O0nLfFbYiX9toMoFQ6BeZv2f1Dz4YE:AVmcqGIzkiFURlXoM56EJAJ4YE
TLSH
T15263BE80973E9894B93B8BB3A0452646BA75C5DD5D73FEB2CAB3E3192CD9F1000F9805
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4724	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Ratchet.and.Clank.Rift.Apart.v3.630.1.0-P2P.torrent
1⤵
- Modifies registry class
PID:1572

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact