Overview
overview
3Static
static
1wsgidav-ma...ke.bat
windows10-2004-x64
1wsgidav-ma...ke.bat
windows11-21h2-x64
1wsgidav-ma...le.bat
windows10-2004-x64
1wsgidav-ma...le.bat
windows11-21h2-x64
1wsgidav-ma...us.odt
windows10-2004-x64
1wsgidav-ma...us.odt
windows11-21h2-x64
1wsgidav-ma...onf.py
windows10-2004-x64
3wsgidav-ma...onf.py
windows11-21h2-x64
3wsgidav-ma...unt.js
windows10-2004-x64
3wsgidav-ma...unt.js
windows11-21h2-x64
3wsgidav-ma...pi.bat
windows10-2004-x64
1wsgidav-ma...pi.bat
windows11-21h2-x64
1wsgidav-ma...ke.bat
windows10-2004-x64
1wsgidav-ma...ke.bat
windows11-21h2-x64
1wsgidav-ma...nt.bat
windows10-2004-x64
3wsgidav-ma...nt.bat
windows11-21h2-x64
3wsgidav-ma...tup.py
ubuntu-18.04-amd64
3wsgidav-ma...tup.py
debian-9-armhf
3wsgidav-ma...tup.py
debian-9-mips
3wsgidav-ma...tup.py
debian-9-mipsel
3wsgidav-ma...msi.py
ubuntu-18.04-amd64
3wsgidav-ma...msi.py
debian-9-armhf
3wsgidav-ma...msi.py
debian-9-mips
3wsgidav-ma...msi.py
debian-9-mipsel
3wsgidav-ma...rks.py
windows10-2004-x64
3wsgidav-ma...rks.py
windows11-21h2-x64
3wsgidav-ma...est.py
windows10-2004-x64
3wsgidav-ma...est.py
windows11-21h2-x64
3wsgidav-ma...ent.py
windows10-2004-x64
3wsgidav-ma...ent.py
windows11-21h2-x64
3wsgidav-ma...).docx
windows10-2004-x64
1wsgidav-ma...).docx
windows11-21h2-x64
1Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/06/2026, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
wsgidav-master/docs/make.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
wsgidav-master/docs/make.bat
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
wsgidav-master/docs/source/Makefile.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
wsgidav-master/docs/source/Makefile.bat
Resource
win11-20260513-en
Behavioral task
behavioral5
Sample
wsgidav-master/docs/source/client_status.odt
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
wsgidav-master/docs/source/client_status.odt
Resource
win11-20260513-en
Behavioral task
behavioral7
Sample
wsgidav-master/docs/source/conf.py
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
wsgidav-master/docs/source/conf.py
Resource
win11-20260513-en
Behavioral task
behavioral9
Sample
wsgidav-master/docs/source/davmount.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
wsgidav-master/docs/source/davmount.js
Resource
win11-20260513-en
Behavioral task
behavioral11
Sample
wsgidav-master/docs/source/make-api.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
wsgidav-master/docs/source/make-api.bat
Resource
win11-20260513-en
Behavioral task
behavioral13
Sample
wsgidav-master/docs/source/make.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
wsgidav-master/docs/source/make.bat
Resource
win11-20260513-en
Behavioral task
behavioral15
Sample
wsgidav-master/docs/source/registerWindowsDavMount.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
wsgidav-master/docs/source/registerWindowsDavMount.bat
Resource
win11-20260513-en
Behavioral task
behavioral17
Sample
wsgidav-master/setup.py
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral18
Sample
wsgidav-master/setup.py
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral19
Sample
wsgidav-master/setup.py
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral20
Sample
wsgidav-master/setup.py
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral21
Sample
wsgidav-master/setup_bdist_msi.py
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral22
Sample
wsgidav-master/setup_bdist_msi.py
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral23
Sample
wsgidav-master/setup_bdist_msi.py
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral24
Sample
wsgidav-master/setup_bdist_msi.py
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral25
Sample
wsgidav-master/tests/benchmarks.py
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
wsgidav-master/tests/benchmarks.py
Resource
win11-20260513-en
Behavioral task
behavioral27
Sample
wsgidav-master/tests/conftest.py
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
wsgidav-master/tests/conftest.py
Resource
win11-20260513-en
Behavioral task
behavioral29
Sample
wsgidav-master/tests/davclient.py
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
wsgidav-master/tests/davclient.py
Resource
win11-20260513-en
Behavioral task
behavioral31
Sample
wsgidav-master/tests/fixtures/share/Lotosblütenstengel (蓮花莖).docx
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
wsgidav-master/tests/fixtures/share/Lotosblütenstengel (蓮花莖).docx
Resource
win11-20260513-en
General
- Target wsgidav-master/tests/benchmarks.py
- Size 7KB
- Sample260604-phl2daet5z
- SHA256 9e7bb9c68268ea99721e9cda507c56d65c874eaabbecf0001cfc849ed38c96cd
- MD5 91b4e65f3fe6a1c4aa02be4d5ba1942c
- SHA1 68de46aa41adbbc59cd508d7510181228f0f7c6c
- SHA512 1d608a003d17561d2ca35bda9d787186887a15778de46dffeec87ab9722efdfaedf7de35357556e93f1ac1e12c70ce819e22a71a601391d95b95194de9a4bb0b
- SSDEEP 192:3Ip12hFHOjTbDqrPWozUnJUs8TVYRnuaBUtycSr6WVxUX980GqPZ8qwZ8m6ILai:YpYPKC3w9RdgKqwZ5
- TLSH T132F194069C368823AB93DD55AD83D452F338DA0F4746B468BECCD9CD0F2693122DD66E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5232 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\wsgidav-master\tests\benchmarks.py1⤵
- Modifies registry class
PID:3220
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5232