ced8796ae647584824c9907d0513f2d2f4b63f9b5bb9cf713e5a59a777335824

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/02/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1uunov24.py
Size 1.4MB
Sample260225-syrtcab15g
SHA256 ced8796ae647584824c9907d0513f2d2f4b63f9b5bb9cf713e5a59a777335824
MD5 caba8dbc0b938fed9695d2ea62fb3e6d
SHA1 cea4c11ef800e6bc7cb0259fab8fa85b6798127c
SHA512 3c1653ff402a52e2349a256d54c29a7670e8f79da29a7fd026bff980ab4aa991f92beb5326d4023e2ce4d13d975a907ae2f4012e05a3707b21d93b686c4933a1
SSDEEP 24576:dcBDhT68qo1n6fW4NuFp4DTfQB9uDZfE7mZzPOA1k9+/K:dEpWWoDQBP9b
TLSH
T1F36523918E5E7D95060C9314320F97089B207B50907EFDF277A426E647EEB4A8BD387E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3492	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\1uunov24.py
1⤵
- Modifies registry class
PID:4768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3492-1-0x000001537E550000-0x000001537E5FF000-memory.dmp

Download

memory/4768-0-0x000001DFA1DB0000-0x000001DFA1E5F000-memory.dmp