781b8f381135f435cc8795d6a744654ee651af26a43107b57075fc8f7d181792

Analysis

user interaction
yes
max time kernel
106s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 22:28

Target
rw.py
Size 1KB
Sample260602-2dtxmsfy2q
SHA256 781b8f381135f435cc8795d6a744654ee651af26a43107b57075fc8f7d181792
MD5 84f7a9327d6df8f90bedbe66f1048b2e
SHA1 2addc5d802f7ac619ee935c1cdbd40e3056a7b80
SHA512 e1e7a1724e85b9a588febf8d800fc337fbb60de10bfb71d3adc364026cb5020470b7cda25ff67229fca6b0ccfeade36a8668d0b9ec50249d7ff1e81019a05b10
TLSH
T1CE21DF46DE09081088B153DC6A25F466F319624F6735150B3EACF9647F34062A7FDE7D
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4124	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\rw.py
1⤵
- Modifies registry class
PID:396

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact