26b7450998b5e04410a77486c695457c58dcbc8db24f50cc685651d223f3be8e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 09:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
冬令营课程重点内容与注意事项/__init__/Crypto/Cipher/_EKSBlowfish.py
Size 5KB
Sample260423-lnj77agy71
SHA256 26b7450998b5e04410a77486c695457c58dcbc8db24f50cc685651d223f3be8e
MD5 a5f07807c63a0a82cfe7f644d72c9f9d
SHA1 4f44ed26fd9770a9b8ed279c9e75ffeb2c84b756
SHA512 535fdcfdddf7d64d097b0b51f64ebd14d453895b167e379d105e15f8f9681100b324a02004a3dd059b599ef88c01b81e0ad5546e90f1251ea2172ba5df6d9252
SSDEEP 96:MHDqrYJALrYJHdt3EHGuITiwnHav1ZaVDYyOKgiaiJrJtk3I99m2Ht3HRF29:0qrskrs9t3q/ITHSVNi1bk3ITm6tXRY9
TLSH
T1D2B1B8030D42CBC22776554A3D3EB888E32532273B619A1339BD925C6F37739E55A298
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4116	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\冬令营课程重点内容与注意事项\__init__\Crypto\Cipher\_EKSBlowfish.py
1⤵
- Modifies registry class
PID:4564

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4116-0-0x0000016360A90000-0x0000016360AFB000-memory.dmp

Download