89b2a2e2adeaded60bc2567f196dd4d50cc2c75912c163f1d8cbc986e8521709

Analysis

max time kernel
191s
max time network
185s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/06/2026, 13:13

Target
renpy/py3analysis.py
Size 23KB
Sample260620-qgfnmsgv6w
SHA256 89b2a2e2adeaded60bc2567f196dd4d50cc2c75912c163f1d8cbc986e8521709
MD5 1e49e5d50925ab9c0cab01dc70d9f2cf
SHA1 4482dc339ba0888c30f345be833bf735d0256b6c
SHA512 14aa7b3f1bc5b503801edba75639c6a5c58d1fbf56a533736e8447280b44ef2652bf7f5e3a114d0b950f98b76cf9b42d55f090776a7f34d1d9c8e3613794ee47
SSDEEP 384:BKXkUt5FUvu6Xh5L4u3YjYycWbRzrMWtfTLwJQeBJqP5egt:IXkUt5FUm6XhtyptbRzrdJwieBJCXt
TLSH
T155B22016D2611B75920B88B529CBF0037B5EBD47B16CA0B979BC848C2F4662981F3DFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3328	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\renpy\py3analysis.py
1⤵
- Modifies registry class
PID:3940

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact