93b05fd8bd52bad94f5a0fdbc4e44a8002066475b2435a633cec29a649d501b6

Analysis

max time kernel
298s
max time network
203s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/03/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
thomsonite.ini
Size 266B
Sample260301-ryw8dsd18e
SHA256 93b05fd8bd52bad94f5a0fdbc4e44a8002066475b2435a633cec29a649d501b6
MD5 579c5a1501e26aebab7a715a787c35f6
SHA1 9572f72c37d21a49b82482aae98d7276a7993fc3
SHA512 7472770da80b6708afb1c7fac9057a709e41653cb17185345db514023c6ab1a6b665b7a5834799f5b4aedf18f19fcd85c3021c0e0911bc147024614dd8bdf606
TLSH
T104D02B19595F7842C327DAE0FF4B2CA4550CE725511D46323D45D3CD34D8106D88F10C
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3356	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\thomsonite.ini
1⤵
- Modifies registry class
PID:3404

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3356-1-0x0000029700480000-0x00000297004B1000-memory.dmp

Download

memory/3404-0-0x0000028C2D200000-0x0000028C2D231000-memory.dmp