2b328d9be0c55a5e38a742e3c7294168bf70b779721d310d68964526cbd6c0e7

Analysis

max time kernel
28s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
extension/config/cars/cf/Camaro_Addons/diffusor_2013.kn5
Size 23KB
Sample260508-e6pgascz8w
SHA256 2b328d9be0c55a5e38a742e3c7294168bf70b779721d310d68964526cbd6c0e7
MD5 f550d20178c2ef8af1ea1bc54d6e2243
SHA1 d81321c7c8fa3dc783c756f852ca6b8dcc4f674e
SHA512 b857a13da2763a86a1b5524e2ec190578361ae470a7f74ed2205d4718a4030d3c19069045e5a55bdde08c61ded02854d1c1c8ad43d928fc9d51bf50447cf0938
SSDEEP 384:HNa0KWV38X8ynAKPzB2qgOGtkT8ToQni9M0bYsHfY42kUFhgfzW+AQueGnMMLbV:o0r1ynnPzsZtjWYlThgfCdeGnMMLbV
TLSH
T1C0B2AE23F8E50ACCD6E93073C4E69C41063172E274321A52AF9C5A52DCA5DF8FE1A279
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4432	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\extension\config\cars\cf\Camaro_Addons\diffusor_2013.kn5
1⤵
- Modifies registry class
PID:5956

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4432-1-0x0000019A85FB0000-0x0000019A86328000-memory.dmp

Download

memory/5956-0-0x0000028921C60000-0x0000028921D0E000-memory.dmp