7beff8e3153ee395fec616046f0c39dff785a6b5a0762a8639756925c6aec5ab

Analysis

max time kernel
18s
max time network
20s
platform
windows11-21h2_x64
resource
win11-20250218-en
resource tags

arch:x64arch:x86image:win11-20250218-enlocale:en-usos:windows11-21h2-x64system
submitted
09/03/2025, 09:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

clean.pyc
Size

17KB
MD5

893a62c02c92c9cb4e8c78a90864991c
SHA1

80874745bc93558c631ef529e27e33073178fc07
SHA256

ccc0b43b6b1f158587a4300500227528e96d1986a5306567d8c4a0a4574aaf76
SHA512

8aa3ac336078f4f034911440e3226d54ba0eb7329a57f7b8a44e0eff43215e94815a0db2b172bef8ec94379f6029e22c8bee8b456efddf53b2b8f10247d5f629
SSDEEP

192:Z+UE0rURjemlylYrZA8cHTcAQiUaXpwTkXHE+9sG9IGGEA7c4:ZpE09mlylYrlcHeXaXp6o77CPE8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3384	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\clean.pyc
1⤵
- Modifies registry class
PID:3672

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=3928,i,4634074957638558700,2080510381543222728,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:14
1⤵
PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...