2e509a287269704ccd75db57a9db01d6e5e424aaafdb3e7ceb3f4b8118190136

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mod__.pyc
Size 86KB
Sample260426-tree4sey3l
SHA256 2e509a287269704ccd75db57a9db01d6e5e424aaafdb3e7ceb3f4b8118190136
MD5 dfb3ead7f87e010a637f576d467cd55e
SHA1 b45ddda4113753dfbcda0b6943d2f66928d873da
SHA512 456c68b7436042daf694be11a47a325f5292eca0a0aeaea6923790d10ebee16947e253fff0c6e90c0acdb4a5eb75c6df9b6eda8ffa077e08c1985cdee9ca7489
SSDEEP 1536:sXjJvARiArFY4LDd6wK2orzgb+v8P80m6J5NbWq8QEhq/B1ZTtgKbGDzM68o:jHrNDd6wJu28U5NF83I1ZZgqmg68o
TLSH
T17D8302094EEED4889D7E4019F90CE0239B0ADD798706FE6A91454E58F9FBC6560CF70B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4932	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\mod__.pyc
1⤵
- Modifies registry class
PID:4700

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4932-0-0x000001A3F9850000-0x000001A3F996E000-memory.dmp

Download