b197948eacd76b02a5bf42fdd009a0a51a19fe0bcc571c9e6a98bbbaf1ad12cc

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 09:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
冬令营课程重点内容与注意事项/__init__/Crypto/Cipher/PKCS1_OAEP.py
Size 8KB
Sample260423-lnj77agy71
SHA256 b197948eacd76b02a5bf42fdd009a0a51a19fe0bcc571c9e6a98bbbaf1ad12cc
MD5 6a73b6acedb0fbfbd341f54b3d645d2e
SHA1 45e81d77db3f9c3b0d520bf061bad1ca19172d26
SHA512 0627010bd065d3fbc5b4a41b90ac8078a9524c722b485cbda0b7d9f988075102c74f5468774700873d0d7be1e0dd2df6329bdae3644b54ed3e788593e9218e9e
SSDEEP 96:dEFQHvo7wHV2QRL34mghqko9uNizI3y5xU3a5tLVZCMKesDBC7IM2ef9o20kqk9i:d6QHvT3GFA6Iywx2XQ6UF9kv
TLSH
T14D12C69B8D06ED9D62F3880ABD7AE00ADB13418B76E9571A30DCDA044F7433C51E5ED8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3468	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\冬令营课程重点内容与注意事项\__init__\Crypto\Cipher\PKCS1_OAEP.py
1⤵
- Modifies registry class
PID:788

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/788-0-0x000001F953860000-0x000001F9538BD000-memory.dmp

Download

memory/3468-1-0x0000023A27370000-0x0000023A273CD000-memory.dmp