ef7220d8bc8a9cce0341a88026eef346facaed0f859525d55184caf4df18cb57

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/02/2026, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
main.pyc
Size 12KB
Sample260211-leyn8aes8e
SHA256 ef7220d8bc8a9cce0341a88026eef346facaed0f859525d55184caf4df18cb57
MD5 0ee8963c24b008f9a96fa492c89e69ef
SHA1 5628d9974ea0d4d4c3c5c1a77370ef664d0a8aba
SHA512 bc0f7569892dbe8c426997c35fe5439a79be8f753a0c0c2801c8529d29bf5b3982092eaff16bdace479e68efa248b1c38ac7b26ede4a214299fb62475fb4dbe3
SSDEEP 384:itYLLo88lQu1DnZnmQ3+9KCAbwgYVJrQkn:22LoHVDnVckb4SG
TLSH
T1C342CF261C44D5B7CBB888B3DD6EC55E7ACE350A04B286FF56049990D57DAC801F9DC3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
816	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Modifies registry class
PID:4680

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/816-0-0x0000021A98320000-0x0000021A983C3000-memory.dmp

Download

Resubmissions

Analysis