92e60589d286a8cb24a145990a2968cf1effaf899ab4d324888542a5ab3bf219

Analysis

max time kernel
598s
max time network
429s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
12/07/2026, 15:36

Target
VareiaExe/Vareia_Data/RuntimeInitializeOnLoads.json
Size 5KB
Sample260712-s2d2naet4y
SHA256 92e60589d286a8cb24a145990a2968cf1effaf899ab4d324888542a5ab3bf219
MD5 89c7ceb1a5ce950a7485b9869fcf3359
SHA1 ee1982405562b4744bf0a77d1ba908eea5732fe8
SHA512 1af74a907f23ebf3677d5c53e2e719ad6905a575e3b8338b2f8d33b231573f91797f0eef0da371ccb273265577503e545b7349f8a34b4074925b12fd8a87e133
SSDEEP 96:xkZUzgpS8ZmHFIvaT9De924g/81z0CpSmZsiC4v0IsyLGYD2tIP7NIQ:xuUz4S8ZmHFIvaTAU4a81IbusiC4vTsG
TLSH
T1D2C143BC22878F7F5F8BC39B797A2A5D35840A0F89CA5804DDBD1F2F95B0115298622D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2060	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\VareiaExe\Vareia_Data\RuntimeInitializeOnLoads.json
1⤵
- Modifies registry class
PID:4952

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact