Analysis
- user interaction
yes - max time kernel
149s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/04/2026, 01:04
Behavioral task
behavioral1
Sample
MorisMacroMaker.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
MorisMacroMaker.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
main.pyc
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
main.pyc
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target main.pyc
- Size 2KB
- Sample260418-be9rdaet8x
- SHA256 cd40dca8721814d2a4c1acddb1e04bc8b2e29cafbcaf2a0f06240128a8c77264
- MD5 d6b1a3011fa13d595eb7bea23015c7c5
- SHA1 c3564c2ba5d0775c8e9fe3e65fcd78cb8b6a1744
- SHA512 28929c485d79aed1724d0089976424fe21f37a154bfde7735380fc2aba5b57dacc51c7b8e1aa386059413d0b4057789ef5123020a03fc179f56ca93ad0252008
- TLSH T15051A5D27200DA72FFE12770852B660EF771D5F4B2A5EF9B5358A0963E10625AEB00CD
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\\ = "pyc_auto_file" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\0\ = "pyc_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\pyc_auto_file\shell\edit OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\pyc_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\.pyc OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\pyc_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\pyc_auto_file OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\䠖Ꝕ⾍缁\ = "pyc_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ꇐẪƔ OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\pyc_auto_file\shell\edit\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\⣜垉㻿蠀厈奫翻 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\鹐ẪƔ\ = "pyc_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\pyc_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\印奫翻 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\pyc_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\印奫翻\ = "pyc_auto_file" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ꇐẪƔ\ = "pyc_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\鹐ẪƔ OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\⣘垍䀀耀 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\.pyc\ = "pyc_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\⣚垏㼀蠀奧翻 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\⣚垏㼀蠀奧翻\ = "pyc_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\pyc_auto_file\shell\open\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\0 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\⣘垍䀀耀\ = "pyc_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\䠖Ꝕ⾍缁 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\⣜垉㻿蠀厈奫翻\ = "pyc_auto_file" OpenWith.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1136 NOTEPAD.EXE - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5296 OpenWith.exe - Suspicious use of SetWindowsHookEx 31 IoCs
pid Process 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe 5296 OpenWith.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5296 wrote to memory of 1136 5296 OpenWith.exe 103
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc1⤵
- Modifies registry class
PID:4896
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\main.pyc2⤵
- Opens file in notepad (likely ransom note)
PID:1136
-