2cbbd85b65288eafacdd1078886412b4db7028b2426e9e78fc0966ac9c72dca7

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 10:35

Target
lib/python3.9/_collections_abc.pyc
Size 31KB
Sample260628-mm3htagv9t
SHA256 2cbbd85b65288eafacdd1078886412b4db7028b2426e9e78fc0966ac9c72dca7
MD5 f1d26a6e70afcc9b37d04638669eca5e
SHA1 3434a10216fe9effbb8f0fa4c7b38bbd151eb552
SHA512 9533623e12c78c417b9633e6f63f458178a84bc90a2bdf35cdc55646a79b5b258e353e51faa16673b711acae495e9fe14f114e7d2496bb4fdd4988b7de9a114d
SSDEEP 768:/GJgavbRORmFHGyiajSVnsximHAC6t2TqBuuUBlMKzR:QbvbMRByiRsximHAC6tNuuUBlMwR
TLSH
T157E262C1DEC2EE67F855F2B940760128BB24D2E3B23C8297350DA57E2E07E8499F5D94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1576	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lib\python3.9\_collections_abc.pyc
1⤵
- Modifies registry class
PID:2520

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact