f657f8d18cbfc02b5c93e4b85206ff53f5b0b3ebda1f96aaadf499339e511798

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 15:17

Target
rk3326-r36s-sauce-panel2-linux.dtb
Size 87KB
Sample260625-sphjbads8m
SHA256 f657f8d18cbfc02b5c93e4b85206ff53f5b0b3ebda1f96aaadf499339e511798
MD5 b7052b669a9169e1ccf7d84794b2830b
SHA1 3fea9a1a31b6445ccdbb812adaf9dfe57f058b61
SHA512 d7b3a9b38c31adac8c10718308afb644d20f3ee8fe618334e15a8343ce062f7771700f82e769ea922219b27ead2c53f8fc66ae10e7f419f30969d7cf1c87d042
SSDEEP 1536:6GfbRD1SzNmeBeVJdfCuEG358XNFTVFvoEG7MQkNz9HOwSLEpgt6O5kSC2T2sW:6QEG358XNFTVFvooQkNz9HOwSLEpgt6j
TLSH
T1F793524C67E0AE73F0552B3011DB4A417338F4A1EFE7DB07728497AA16467C113BAAAD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2104	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\rk3326-r36s-sauce-panel2-linux.dtb
1⤵
- Modifies registry class
PID:2588

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact