38da265db608a4f9acc111b1b2f6260c51fa8b5ba63f20f52e0e1d5b65abf7c5

Analysis

max time kernel
28s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/05/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
extension/config/cars/cf/Camaro_Addons/EU_Tails_Lod_C.kn5
Size 87KB
Sample260508-e6pgascz8w
SHA256 38da265db608a4f9acc111b1b2f6260c51fa8b5ba63f20f52e0e1d5b65abf7c5
MD5 e5c8881f618b679aedc5b2cde3948fa9
SHA1 b995ec2c111b73102cbb1005cb426e71749b89b3
SHA512 191303c560635b849745bc9215d6faa9390fc02a40ba1e933d311d16125fb328f050d8c6de543d00876503963a2b4c63c3798d382867e35c0804615a5f522c49
SSDEEP 1536:g7uZUFrJRhVWf4xqzgCMFsNMz3qSt0EkA2RYLLUfkd2CX+:g7wmqJ6TqStGYLwf0tX+
TLSH
T1F793CE5EAF16455AC475017A18390F31C72C64FD66312AA323F7ADE63A8E07D1F98E32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4312	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\extension\config\cars\cf\Camaro_Addons\EU_Tails_Lod_C.kn5
1⤵
- Modifies registry class
PID:1124

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1124-0-0x000001F6D9880000-0x000001F6D992D000-memory.dmp

Download

memory/4312-1-0x0000019B5D930000-0x0000019B5D9DD000-memory.dmp