1cabaf1ebd125977de72e00138356e991fcc35454aa79fc5c54a5b30e1e395b3

Resubmissions

20/08/2026, 20:51

260820-zm99waysds3

20/08/2026, 16:11

260820-tm2pvatzdt3

20/08/2026, 15:25

260820-st48wazelc3

Analysis

user interaction
yes
max time kernel
324s
max time network
327s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
20/08/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DDNet-20.0-win64.zip
Size 65.3MB
Sample260820-st48wazelc
SHA256 1cabaf1ebd125977de72e00138356e991fcc35454aa79fc5c54a5b30e1e395b3
MD5 0b77cc890022c3c737d370b95928b502
SHA1 cf97d39af46e7df24d0bc98f87072f321860c710
SHA512 6c0c28ed1cdad1e6cad2870c958724f5085cfe7bfe7dcfb103d0797ba4deec6679c5a3e666ba2ceeeac423e10ed9532438a886e30ac6a3efb219899711d73f8b
SSDEEP 1572864:4p8EpE6y9aXCtGVpz0aQWx2LsSlpkPL2W9G29/AuPHMCF:4OEpEN0y4zAaYoiWzPMCF
TLSH
T101E733F9C8808900EC1F9C745739EA499DB872F57922924D5F60424DAE8BFC2F635AC7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Kinetix.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Kinetix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Kinetix.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Kinetix.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Kinetix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Kinetix.exe

Modifies registry class 31 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ddnet	Kinetix.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ddnet\shell	Kinetix.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ddnet\shell\open\command\ = "\"C:\\Users\\Admin\\Desktop\\DDNet-20.0-win64/DDNet.exe\" \"%1\""	Kinetix.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\DDNet.map\DefaultIcon	Kinetix.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\DDNet.map\shell\open\command	Kinetix.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\DDNet.demo	Kinetix.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\DDNet.demo\shell\open	Kinetix.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\.demo\ = "DDNet.demo"	Kinetix.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ddnet\DefaultIcon\ = "\"C:\\Users\\Admin\\Desktop\\DDNet-20.0-win64/DDNet.exe\",0"	Kinetix.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\DDNet.map\FriendlyTypeName = "DDNet Map File"	Kinetix.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\.demo	Kinetix.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\DDNet.map	Kinetix.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\DDNet.map\shell\open\command\ = "\"C:\\Users\\Admin\\Desktop\\DDNet-20.0-win64/DDNet.exe\" \"%1\""	Kinetix.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\.map\ = "DDNet.map"	Kinetix.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\DDNet.demo\DefaultIcon	Kinetix.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ddnet\shell\open	Kinetix.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\DDNet.map\DefaultIcon\ = "\"C:\\Users\\Admin\\Desktop\\DDNet-20.0-win64/DDNet.exe\",0"	Kinetix.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\DDNet.map\shell	Kinetix.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\DDNet.demo\shell\open\command	Kinetix.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\DDNet.demo\ = "DDNet Demo File"	Kinetix.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\DDNet.demo\DefaultIcon\ = "\"C:\\Users\\Admin\\Desktop\\DDNet-20.0-win64/DDNet.exe\",0"	Kinetix.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\DDNet.map\ = "DDNet Map File"	Kinetix.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\DDNet.map\shell\open	Kinetix.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\.map	Kinetix.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\DDNet.demo\FriendlyTypeName = "DDNet Demo File"	Kinetix.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ddnet\ = "URL:ddnet Protocol"	Kinetix.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ddnet\URL Protocol	Kinetix.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ddnet\shell\open\command	Kinetix.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\DDNet.demo\shell	Kinetix.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\ddnet\DefaultIcon	Kinetix.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\DDNet.demo\shell\open\command\ = "\"C:\\Users\\Admin\\Desktop\\DDNet-20.0-win64/DDNet.exe\" \"%1\""	Kinetix.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3952	Kinetix.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\DDNet-20.0-win64.zip
1⤵
PID:5072

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1668

C:\Users\Admin\Desktop\DDNet-20.0-win64\Kinetix.exe
"C:\Users\Admin\Desktop\DDNet-20.0-win64\Kinetix.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3952-11-0x0000000062E80000-0x0000000062EA6000-memory.dmp

Download

memory/3952-5-0x00007FF8894C0000-0x00007FF889570000-memory.dmp

Download

memory/3952-3-0x00007FF889570000-0x00007FF889617000-memory.dmp

Download

memory/3952-14-0x0000000064940000-0x0000000064955000-memory.dmp

Download

memory/3952-13-0x00007FF889310000-0x00007FF8893A2000-memory.dmp

Download

memory/3952-12-0x00007FF897450000-0x00007FF897462000-memory.dmp

Download

memory/3952-10-0x00007FF888520000-0x00007FF88869A000-memory.dmp

Download

memory/3952-9-0x00007FF889040000-0x00007FF8890EF000-memory.dmp

Download

memory/3952-8-0x00007FF89EBD0000-0x00007FF89EBE5000-memory.dmp

Download

memory/3952-7-0x00007FF887340000-0x00007FF88757C000-memory.dmp

Download

memory/3952-15-0x00007FF8860B0000-0x00007FF8871C4000-memory.dmp

Download

memory/3952-6-0x00007FF889470000-0x00007FF8894BE000-memory.dmp

Download

memory/3952-4-0x00007FF8A0050000-0x00007FF8A0078000-memory.dmp

Download

memory/3952-2-0x00007FF888B00000-0x00007FF888ECF000-memory.dmp

Download

memory/3952-1-0x00007FF8898F0000-0x00007FF889977000-memory.dmp

Download

memory/3952-52-0x00007FF887340000-0x00007FF88757C000-memory.dmp

Download

memory/3952-162-0x00007FF887340000-0x00007FF88757C000-memory.dmp

Download

memory/3952-222-0x00007FF887340000-0x00007FF88757C000-memory.dmp

Download

memory/3952-282-0x00007FF887340000-0x00007FF88757C000-memory.dmp

Download

memory/3952-327-0x00007FF887340000-0x00007FF88757C000-memory.dmp

Download

memory/3952-357-0x00007FF887340000-0x00007FF88757C000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads