6d0c347813e68534d7e6707e65bdff72b4b30eed0f395a64783ef4538f55ef3a

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app.asar.unpacked/node_modules/node-pty/deps/winpty/ship/ship.py
Size 3KB
Sample260502-werwsac121
SHA256 6d0c347813e68534d7e6707e65bdff72b4b30eed0f395a64783ef4538f55ef3a
MD5 e29b532c8a02c94736032888b095be53
SHA1 8d9c3c07cb7ffc642d00a3e17b8494b9fce3179f
SHA512 76f35d92e2ed9f36c7ae40396e13daeff7a14e00bdbfc0d5c358cbfea1c5a5568a019a3911194f31cf792cf28d43961f9400e439ada239941f16fa12d0cd20d0
TLSH
T185816451A3450B6264D23754763A3B4F67B3B2773FA12C0436AEC1849F5E82F90B393A
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4432	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\node-pty\deps\winpty\ship\ship.py
1⤵
- Modifies registry class
PID:3556

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3556-0-0x0000017D1D1D0000-0x0000017D1D27E000-memory.dmp

Download

memory/4432-1-0x0000023929FA0000-0x000002392A318000-memory.dmp