5ad02761098cccd6e0439da5d803e04c9cb3873fd12596b824b966942488bfd8

Analysis

user interaction
yes
max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 00:06

Target
ac883a-Custom Moon & Skydome Mod by CrankV2.rar
Size 72KB
Sample260722-adzz4sgf34
SHA256 5ad02761098cccd6e0439da5d803e04c9cb3873fd12596b824b966942488bfd8
MD5 cbbb1be71a36c66866c10b875be63b38
SHA1 a614ca161f974358863620f1aaad8235d8fd5af6
SHA512 b77781a09ac74a5925527193e1a4bfc109bbe4bdab503a613a3585569bef96b7a33eddbda0dde4bb9dce60ed992111837dc37bf02f70dabe842f65cb8d4bcfff
SSDEEP 1536:MXJF/8CF+u/cr6modjrhSacItLZZ8irj6gNNTWTr8UuS5C4uZ3n:MX0g3crNodG6ppzSA4u5
TLSH
T16A7302CE91E2206903615346D5DBF03A7DCCD51A99884EAE0B122AC39FF7777B22C749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

ransomware

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	7zFM.exe

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
1920	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4864	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1952	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1920	1952	OpenWith.exe	90

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO003BE3B9\skydome.ytd
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1920

skydome.ytd

Path C:\Users\Admin\AppData\Local\Temp\7zO003BE3B9\skydome.ytd
Size 72KB
SHA256 b735ecdac42ae736c36fa43285ca3559841f860e419f012cc83f1571ce9fe868
MD5 04c4e2bc485de94aca512dfb94a7e82c
SHA1 33319e04d9d5d833d3c9271b140b05c8168020cb
SHA512 22001dd7572873c5a009ae92bbead27baa8b1d6fa61d85912b4d0e4daf2eb701e48678ff0d35e13791da82d055cae5371698acdef250f084a47693220388afc2
SSDEEP 1536:5z0/FpPXeJJ6ajTvcGAIX2O73GFWRDRyPRA5IDy18Hkxb5zY:5zsFOJJ6adlX/FRMeay1z0
TLSH
T1BA7302DAF8F0B49EF066AA3949B5DFC420D35B480453D6EB4951EFE88718C34A60F85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download