141a493583bc88a30ff51d1158df8b7ddb118d6bf61af6b7c403e70b0b4534be

Analysis

max time kernel
29s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 04:33

Target
extension/config/cars/cf/Camaro_Addons/body_2014_2015.kn5
Size 97KB
Sample260508-e6pgascz8w
SHA256 141a493583bc88a30ff51d1158df8b7ddb118d6bf61af6b7c403e70b0b4534be
MD5 640ceb2a79569b2579b3f9f95d0f32bc
SHA1 2434fcc365e2bb72257402998ae4ece70760427e
SHA512 42e5b3a23a8ea198ce18e623ac8bfc6441e410e262eae2227a5cc5086e3b28c1df1bbd01b20dd0cb4403964bfe4ea55f6ccf39557959c9b632e05c4bdb868340
SSDEEP 1536:dx0epFmIRprGvO+mK41gkj3ZfMNYF/Ek7zNYAPrknmYZgUaf5HrlLYG1XpnvuftG:dfrG594Dj3GYeeJMZgUUrlLX1NmftG
TLSH
T141A3CF6C710F42A5E070D1B9AD567FB08A2012FE54C01AB7FF7394E7B848C3D1EA49A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-643422742-1162610606-620613169-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4480	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\extension\config\cars\cf\Camaro_Addons\body_2014_2015.kn5
1⤵
- Modifies registry class
PID:5280

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact