354f190527fc5ea8edae742bb1087b4693d19f286785d6bab120f7cc2dbcc12f

Analysis

user interaction
yes
max time kernel
898s
max time network
447s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 21:08

Target
cheat.BAT.py
Size 180KB
Sample260522-zzbbbaht2v
SHA256 354f190527fc5ea8edae742bb1087b4693d19f286785d6bab120f7cc2dbcc12f
MD5 94c02907f8586b1f5bfb511b704b6a67
SHA1 980408444d4d1c3bf472e444b93846504b9fdb14
SHA512 e26e522716fad18c15e054887b7031c3a58c586dfd323a2212ff2c8a8593f6564b61fa65908a3c299d51f52db3aed4fcae0958bce47b1515c2ca623aa6487287
SSDEEP 3072:v9J79P1luL3WvfjQpxcDvLzCC3bALS7UL9ZLm7kI0UK/G:1J7/luL3oUpxKzCYbALT3mk/G
TLSH
T190048CA18C02542356B1DB5D1E07DC21FB394B736621AE227FBC81191FFD462A2F6B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1476	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cheat.BAT.py
1⤵
- Modifies registry class
PID:5068

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact