b934c080a9e28ce5a0b8b52e0b3c0c9c8d229d714e1958c9b584d903912aa5f6

Analysis

max time kernel
599s
max time network
479s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/06/2026, 23:37

Target
data/python-packages/sys_config/sys_check.py
Size 6KB
Sample260622-3mhfmsgz7m
SHA256 b934c080a9e28ce5a0b8b52e0b3c0c9c8d229d714e1958c9b584d903912aa5f6
MD5 d77bd4efdc3edb2cd7019597d0068467
SHA1 44da7d070ddb5439cdc0ab943e430f9b05ba1d96
SHA512 7b6f9c5719580b2f5f9410614fb5011515021cf7ac6b8b37d74296b8107e14bcd9a680c0e3a57ac98a151a281c05bee07de22111b327cda600d48ace91fc2ea8
SSDEEP 96:EKMLC1CeQFtEjVmk/qDyTTJR9E8DYNFfr2FaFfarVaR0+R2hKLJTixOddHSSX:nseQEOID3am+R2hKLJTbZSSX
TLSH
T179D142E68C0A6914E34B86291CD3EB1613383E07174CD95C7DACC91CBF414F69AEB8B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4118910392-3846778420-3545080915-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1184	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\data\python-packages\sys_config\sys_check.py
1⤵
- Modifies registry class
PID:5568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2480

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact