ceaf206a91c0d950efbe84fdab3708993201dabd1e7fa7189df45b863f77e58c

Analysis

user interaction
yes
max time kernel
8s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/06/2026, 18:05

Target
payload.py
Size 448KB
Sample260624-wpedfaes8p
SHA256 ceaf206a91c0d950efbe84fdab3708993201dabd1e7fa7189df45b863f77e58c
MD5 8149be849a8422495b65112674a1c9e1
SHA1 112e875af90dcd56dc5f4b62ac197b4aa2e2db12
SHA512 e7624481783af1f20fa7f713e288a7421667480ed88d83f5428ffeef71da3f3c088445ff48f147cb9bf86233b630e4e4a9f1d15abfbb1693f7d6e7f8ab1469a2
SSDEEP 6144:K2szwmxiJ/5taZbVdN26BIBF13CgWsL1p17xjAQilFZ1F8ZT6SHtf5:uI/61F41TWgL11UQiFZ1F8ZT6SHtx
TLSH
T1C0A47C728957ACBB679D6D8498032D8A2E2C794301181838FFCC51F96FEC974CE796B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4828	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\payload.py
1⤵
- Modifies registry class
PID:5512

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact