9858005ffc5e24dbd8c8324aa7a1c677da5f4d256da7970053cf8320ddd295b9

Analysis

max time kernel
599s
max time network
594s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 23:37

Target
lib/python3.9/_bootlocale.pyc
Size 1KB
Sample260622-3mhfmsgz7m
SHA256 9858005ffc5e24dbd8c8324aa7a1c677da5f4d256da7970053cf8320ddd295b9
MD5 b310c1aa498564e607b7323a4c1e5675
SHA1 9d52941323913140830ccdfdffbcf6916b18d193
SHA512 1b75a52813a372e7d5fce372b9319c3c8e832754bd18ad6003a8a0f1f106668f01f69c82abd9c0f282439342d406e8a269793ee4139408c5cc9fede8b2486d50
TLSH
T12A21024A0B015E4BFD21FBF476C5822446B985790E1FB9591715C27A3D0E25C6E514CF
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4112	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lib\python3.9\_bootlocale.pyc
1⤵
- Modifies registry class
PID:5672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:260

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact