1ea53af1c1122c48774bb099de31dbbc514a22ad9169168d5bb65b1b9fe7c71e

Resubmissions

27/05/2026, 12:19

260527-phjagsdt4j3

27/05/2026, 12:13

260527-pdyvdaft2t3

Analysis

max time kernel
119s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lib/python3.9/multiprocessing/forkserver.pyc
Size 8KB
Sample260527-pdyvdaft2t
SHA256 1ea53af1c1122c48774bb099de31dbbc514a22ad9169168d5bb65b1b9fe7c71e
MD5 cba90fdbb6895277240c3714cffea8c2
SHA1 c8658796211c4e591c1af01a7c885643a791aac0
SHA512 bfffc37ed37313b76abfe244477ea1c482efedf8ee6b1477f29d253751798b84d2f059716084441e7a3f7d8441e748b69e520e2fcaf00be33b21f80e263a4f58
SSDEEP 192:S2v6XZgM2G/qwf1ktjfG0DUE7z4eIl9WQOoPSP:uZgM2G/tteTG3pQCSP
TLSH
T17802D6C981190A5BFCA1F3BD681A0B20D79AE376637DD112B61EF50B1FCC2D5A93018E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2596	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lib\python3.9\multiprocessing\forkserver.pyc
1⤵
- Modifies registry class
PID:1404

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads