7ac2874c4adbe90467b183b34b3c256207c8ad828d4e2a884911369706b1adc3

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RedTiger-Tools-1.0-Beta/Program/NSIpPinger.py
Size 3KB
Sample260623-2jpvwagy21
SHA256 7ac2874c4adbe90467b183b34b3c256207c8ad828d4e2a884911369706b1adc3
MD5 32175685c9ce564e54f434059f2007e6
SHA1 7ad516220e9dc17f6c5da004379b173e469a9a3c
SHA512 0129843a0c6f905e7272c9a41251313e36b38aebcde98524c37c5013cb18db51bd883c487cfea250771ff3706022c2002e30a90e6094b8b3ab200294e4040449
TLSH
T12151211267160CE7DBF78458659646023B229D0F4DC3B535BAEC0A921FC793DC57A36C
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4212	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1524	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RedTiger-Tools-1.0-Beta\Program\NSIpPinger.py
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies registry class
PID:4212

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads