6532879c60b92f15d25325181a307377c84a2a25fd76c121f1f4b95bbe1d71b3

Analysis

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lib/python3.9/logging/config.pyc
Size 22KB
Sample260421-cjc4msgz5n
SHA256 6532879c60b92f15d25325181a307377c84a2a25fd76c121f1f4b95bbe1d71b3
MD5 937faf24c8f69af1da9863382f747b02
SHA1 a2e9a36cc5bf2b8fe9a269ea2ba96c135223ff50
SHA512 2862d6fe1fd863f2b96d6775ed28f1d6836c821dcd681fc344c65da8f2f98fd3897ad259040c54d0bfe25402c65de76758253335506d39efc3b019ea41fc56ca
SSDEEP 384:6T6sCSRqlc21fCC6NBmrk0kNP+vOvvPv1hod1fDg4+s4Ji1m8y:66sCSl9C6N4rk0kNWGvntho3c452Sm8y
TLSH
T177A20886B2889F4FFE55F6BAD0450260AB51E3EA074CB4A7301EB14E3F5A1D85D7232D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1628	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lib\python3.9\logging\config.pyc
1⤵
- Modifies registry class
PID:4772

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-1-0x000001FD1A950000-0x000001FD1AAEA000-memory.dmp

Download

memory/4772-0-0x0000017934460000-0x00000179345FA000-memory.dmp