33add5093ee6f9b4f84ef47aa40fcf27f0b09fa3017eb6bc25f4b14ff3c8a53e

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 21:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pcamain.sdb
Size 62KB
Sample260506-z4mvxae13m
SHA256 33add5093ee6f9b4f84ef47aa40fcf27f0b09fa3017eb6bc25f4b14ff3c8a53e
MD5 8a57564263d00e7e2e16ee49221d2e18
SHA1 249a54f8afb98ae918db0edbbdbce9c5c4774020
SHA512 9189637ae560a0577ba6dde1db92e3503ff53f52265a94cb258134bf3c4f1b7699b5f5e06b092631c7db8f78fcdd9a74ee8295c5c65d277de7b1711cca69d652
SSDEEP 768:xf+BXh+wr5hwVeJssTzUjbwIa0XrKixaHMLvPJAR4LMd2NTeVoc:No+8hwnsnkHXrJxCR4LMwNWoc
TLSH
T1A653AA762BF61384F1F6C6309AF4478D5B7279278A31EB0CC6583E1E2125869BD50F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5336	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\pcamain.sdb
1⤵
- Modifies registry class
PID:6100

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5336-1-0x0000011CCFA30000-0x0000011CCFDA8000-memory.dmp

Download

memory/6100-0-0x000002ED84410000-0x000002ED844FA000-memory.dmp