70d9b525599d85146924ef8dbdf0980c42a03f4fbb2d01a2cadbf7ed2d43cd93

Analysis

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 09:40

Target
冬令营课程重点内容与注意事项/__init__/Crypto/Cipher/DES3.py
Size 6KB
Sample260423-lnj77agy71
SHA256 70d9b525599d85146924ef8dbdf0980c42a03f4fbb2d01a2cadbf7ed2d43cd93
MD5 44204a7cbbf99e82eb31b7f746b43ab3
SHA1 4589336cf1a1d1e74daaa10e87c898dd804db7f8
SHA512 1d0403f3bcdf6ae8a7a7d2fe339112b7be604ea1d103388547760ff73cbbc7df5106cf6d702a6134cc4c51a836feb3ed42ac0bfde90a46e67f684ecca3ddf4f6
SSDEEP 192:dKQHvCgthz1GPoiRxwKIUK9t4A1zRYotKa:YeCgHAhRn9K9t42NYotKa
TLSH
T1F5E1A5636EC7EDD3257440A22D68E059E722E12F3DE15A5135ADD01CAF71B32E3B618C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1196	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\冬令营课程重点内容与注意事项\__init__\Crypto\Cipher\DES3.py
1⤵
- Modifies registry class
PID:3156

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact