f7070e19a60e1bf2aa5fb590af586328854777554de682ef47a2c2a8580f742c

Analysis

max time kernel
599s
max time network
495s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 23:37

Target
lib/python3.9/_bootsubprocess.pyc
Size 2KB
Sample260622-3mhfmsgz7m
SHA256 f7070e19a60e1bf2aa5fb590af586328854777554de682ef47a2c2a8580f742c
MD5 1e73b6724083ab5dd5c41de3fb2bd812
SHA1 f41b1909e0bf7380553827acfcfa7e8988baf92b
SHA512 d10667f08268fdd524340073b45bc3705e75b4f47f804dd8ad2fc6b4bb892a4f81e7f195fab08de75f4fbd06c0729afcbce777172858058d8a5675ea1340bcee
TLSH
T1C84176DA52B954B3FC61E27F601A12724FB2C539530A5A20251EF9260C4E9D4EC937CE
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2552	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lib\python3.9\_bootsubprocess.pyc
1⤵
- Modifies registry class
PID:5304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2348

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact