743b6c55a6c0e9c5b6303dfef54140d034732eadcf20b6e737b4f972bb37f413

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lib/python3.9/linecache.pyc
Size 3KB
Sample260623-thysdses9x
SHA256 743b6c55a6c0e9c5b6303dfef54140d034732eadcf20b6e737b4f972bb37f413
MD5 e423cb43cf14eb3320da006a5d3b2fcf
SHA1 0f0249584e711cecb52c5e849d88513ce478631d
SHA512 143b451ea9e7f506b0083bd77ec85d8527dd072bc038eef84080dbef722f296c64940190857f2a9a466df0a1103eadea7c5239019d04d28e819a630f38230919
TLSH
T1A981C79A92054A6BFEF4F7BCA24953764A04E57A031BD695F40C80AA3DA029051F8EDC
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5808	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lib\python3.9\linecache.pyc
1⤵
- Modifies registry class
PID:2596

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2596-0-0x00000178EE220000-0x00000178EE29C000-memory.dmp

Download