b5779f84428c9ad5116dfd46ac1fba2c9df9f3f93dc3d955ec0ece8db8565f78

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 09:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
冬令营课程重点内容与注意事项/__init__/Crypto/Cipher/PKCS1_v1_5.py
Size 8KB
Sample260423-lnj77agy71
SHA256 b5779f84428c9ad5116dfd46ac1fba2c9df9f3f93dc3d955ec0ece8db8565f78
MD5 31086f08868555bdcfb3c52df18f022f
SHA1 8f174334253e6f1cd82b60ee90d8a7d82db2da72
SHA512 767ea0778d015619a79ac80be31d6cc63d36f322ef5e36fa9f9c283bff694d4550c47d36ad41c20f5a9ce4f7b39b5b1b1d941b8bafd77a7a68daea0827ac0582
SSDEEP 96:dtFQHvov1zDHk/zN1hXA3ZutH8MKD8LzPodYavD+U8FbPNapkVs3a:drQHv9zjhQ42ME8Hmd8RNu86a
TLSH
T12D02A4479D83CDD952F7486BEDB2F14AEB06A24B2564270738BCD5484F74328D1A1ED8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4828	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\冬令营课程重点内容与注意事项\__init__\Crypto\Cipher\PKCS1_v1_5.py
1⤵
- Modifies registry class
PID:5368

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4828-1-0x000001A7BA050000-0x000001A7BA080000-memory.dmp

Download

memory/5368-0-0x00000122ABD20000-0x00000122ABD50000-memory.dmp