eb6bf21b17ef01c68268e297c280ff521c0be54cec47c4d740d6b30ba946f498

Analysis

max time kernel
149s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ultimate.Ragdoll.Game/game/DLC/Blood and Gore/BloodAndGore.pak
Size 41KB
Sample260819-e53brswgqd
SHA256 eb6bf21b17ef01c68268e297c280ff521c0be54cec47c4d740d6b30ba946f498
MD5 afc6297edcdc48501f95a9758aefa3cf
SHA1 ee3c56962ba7d6e28b4e873c418bccd28e1eb105
SHA512 b6ab83d398904a63cc200812e7889156b1ba83c8353f74ba8dc279cb7b2b8f3591ebd4262caa98f2825ec40ed9a74e932dc1a5198475a5c0ea9c0ee41435e355
SSDEEP 768:nXrUOp5VZPqGppNEg05whPwrCH0AXbtCEV0cL6+lZUitLbk7FmRzk9nN6Cu:nbUOt0GzdweHtXx5u+XUitLm19Ru
TLSH
T1CD13F185B966402FF8FB813C6E810A51D767B65B1B279E5BD8C5D3C29288132AFC6703
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2096	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3024	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Ultimate.Ragdoll.Game\game\DLC\Blood and Gore\BloodAndGore.pak"
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2096

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads