9aee66209a8db41ac9a62dfbf8dded422f3389ddf5d6eb4082fc99ea230c1aed

Analysis

max time kernel
148s
max time network
183s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 07:48

Target
Four_Elements_Trainer_v.0.5.07c-pc/lib/linux-i686/lib/python2.7/copy_reg.pyo
Size 5KB
Sample260620-jnml7se16w
SHA256 9aee66209a8db41ac9a62dfbf8dded422f3389ddf5d6eb4082fc99ea230c1aed
MD5 eb086c211cb0434053d74fef0fd48d46
SHA1 43a777d1db5049fec43bbd77be181eb031459a96
SHA512 0a33912366e15c2f876f4de614d841f5f6e9baba653fe5e673584d78440868fefcc8046b0c7fdeff0e8f29f58c8c4e2ffa04c9b8e41b6b56d6b7099407d25055
SSDEEP 96:iMLsP6Syj+Ol9yeMmp68b3IY3NZDh1fq63E/LHKnTbhwIT2zHCTwgLVbSH:icsCrth9YOdZDf0DHKnTbhwA2zHCTwQa
TLSH
T13EB16280D7D8D867C8EB80B5A0701253EB65F5B761402F4152FCE6BE1AE9764C62F38B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6008	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Four_Elements_Trainer_v.0.5.07c-pc\lib\linux-i686\lib\python2.7\copy_reg.pyo
1⤵
- Modifies registry class
PID:4624

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact