e149ece3fdc97ae4f9263df0c9697cc2f5e372a6899f081a9a81d840d22f3cf8

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/ship/make_msvc_package.py
Size 5KB
Sample260502-werwsac121
SHA256 e149ece3fdc97ae4f9263df0c9697cc2f5e372a6899f081a9a81d840d22f3cf8
MD5 7cff32e87d7d89ed9052b5df6a99f26f
SHA1 4fd3a24458dc62245f5a06e8736b35bfdff6f8ae
SHA512 d2ab37979e2c66656155a5fe357fa3ffb1e9e374623e427cdf1470e10ad81c7b676c30538c4177dc1e6c7cdcb16eed308e1cc2523d57676b2885c8c5fb4f492e
SSDEEP 96:ANsYQHWSoN6Xk2dNziKAX+gtsrKbCn2qon1t5rzSl+iStnbvk608B8J89857o7qe:AjQHWSJXVTAzsrYVnP0APCQ3
TLSH
T1C1B15647C2B4876203434E9536AEB54D5A3B77233B11A48C729CA2881F1F5BD85FB5E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2428	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\node-pty\deps\winpty\ship\make_msvc_package.py
1⤵
- Modifies registry class
PID:3088

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2428-0-0x0000028044310000-0x000002804442E000-memory.dmp

Download