1ea53af1c1122c48774bb099de31dbbc514a22ad9169168d5bb65b1b9fe7c71e

Analysis

max time kernel
149s
max time network
119s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lib/python3.9/multiprocessing/forkserver.pyc
Size 8KB
Sample260421-cjc4msgz5n
SHA256 1ea53af1c1122c48774bb099de31dbbc514a22ad9169168d5bb65b1b9fe7c71e
MD5 cba90fdbb6895277240c3714cffea8c2
SHA1 c8658796211c4e591c1af01a7c885643a791aac0
SHA512 bfffc37ed37313b76abfe244477ea1c482efedf8ee6b1477f29d253751798b84d2f059716084441e7a3f7d8441e748b69e520e2fcaf00be33b21f80e263a4f58
SSDEEP 192:S2v6XZgM2G/qwf1ktjfG0DUE7z4eIl9WQOoPSP:uZgM2G/tteTG3pQCSP
TLSH
T17802D6C981190A5BFCA1F3BD681A0B20D79AE376637DD112B61EF50B1FCC2D5A93018E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1880	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lib\python3.9\multiprocessing\forkserver.pyc
1⤵
- Modifies registry class
PID:1796

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1880-0-0x0000019918040000-0x00000199187EE000-memory.dmp

Download