6367d9f287a7a39c51508bb94a0c52be869ef17ef212824a5f4ee6c34b798851

Analysis

max time kernel
199s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/06/2026, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lib/python3.9/lib-dynload/empty.txt
Size 676B
Sample260620-qgfnmsgv6w
SHA256 6367d9f287a7a39c51508bb94a0c52be869ef17ef212824a5f4ee6c34b798851
MD5 0f073d3ea64f9b0564621e5a9bca8d54
SHA1 734c111c4b00b07627cdf5891ceda4d69d7dbd90
SHA512 d1ad2f4166b4640d798e3a9961b2ac97d76e1c2cf4d0b108c9113b3bd28f06dfecd36fcb996fae505fa8573a80af087ef7275ad444331b8356c56dc846ed7acd
TLSH
T19F01236125C8D57D2648E408DEFBE701791BAC19976B502C73C515275502A95903DBC5
MD5 SHA1 SHA512 TLSH

Score

3^/10

ransomware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2508	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 2508	4612	cmd.exe	81

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lib\python3.9\lib-dynload\empty.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\lib\python3.9\lib-dynload\empty.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads