2e59e547baf132e8553fc76e9ae2151b48c0610483e54130b0b6262a03f95903

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 09:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
冬令营课程重点内容与注意事项/__init__/Crypto/Cipher/CAST.py
Size 6KB
Sample260423-lnj77agy71
SHA256 2e59e547baf132e8553fc76e9ae2151b48c0610483e54130b0b6262a03f95903
MD5 1166b892369e19b4220bbc069d9ccabc
SHA1 f8fffefad392a8d7f79cd644b4d21d771d7458ef
SHA512 b99aa9b0f448b24bcf56deb0bb30b948c1fbae91692a78a291ae30a1935e4c74204a24925573e3e60777b5033cf748fd7c0d4bee3e79bcf3d8d5fbbb19e195ce
SSDEEP 192:d2QHvVgdaKSnrF4xkOUBRkUtmz5t4AyRYotKw:UeVgd8n549aW75t4rYotKw
TLSH
T1FFD1A5625D93DCC326B050A23D78E05DE722A16F2DE25E4135BDE01C6F75F30E2BA289
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3976	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\冬令营课程重点内容与注意事项\__init__\Crypto\Cipher\CAST.py
1⤵
- Modifies registry class
PID:3312

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3312-0-0x000001867D3B0000-0x000001867D45E000-memory.dmp

Download

memory/3976-1-0x0000021320DD0000-0x0000021320E7E000-memory.dmp