Overview
overview
8Static
static
1__pycache_...14.pyc
windows11-ltsc_2024-x64
8__pycache_...14.pyc
windows11-ltsc_2024-x64
3addons.py
windows11-ltsc_2024-x64
3auth.json
windows11-ltsc_2024-x64
3main.py
windows11-ltsc_2024-x64
3run.bat
windows11-ltsc_2024-x64
1stash_capture.py
windows11-ltsc_2024-x64
3stash_dump.txt
windows11-ltsc_2024-x64
1Analysis
- max time kernel
148s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 17:21
Static task
static1
Behavioral task
behavioral1
Sample
__pycache__/addons.cpython-314.pyc
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral2
Sample
__pycache__/stash_capture.cpython-314.pyc
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral3
Sample
addons.py
Resource
win11ltsc2024-20260630-en
Behavioral task
behavioral4
Sample
auth.json
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral5
Sample
main.py
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral6
Sample
run.bat
Resource
win11ltsc2024-20260629-en
Behavioral task
behavioral7
Sample
stash_capture.py
Resource
win11ltsc2024-20260630-en
Behavioral task
behavioral8
Sample
stash_dump.txt
Resource
win11ltsc2024-20260629-en
General
- Target __pycache__/stash_capture.cpython-314.pyc
- Size 6KB
- Sample260702-vw35psax21
- SHA256 2ce3cee28149aa52f0ad0da2a1741326dc5b57f2f1370c70865b68c433729639
- MD5 47354b59d02068901e48fb3440480ba5
- SHA1 e3de5ff58e21d2e531aef0af9d895fce628559f3
- SHA512 4d1a875889a851f5bf309184d4218c365a81fe9a3f59fb33e8c709b0d38e369589f458dab3a7876a471bada071d4d0828b793883457d2e58b4f905d133beb206
- SSDEEP 192:+E7ca9+m7vdMXFaUMmGi8vWHvKPAb8nP7Z+0:+xa9+m7vSXFaUMPi5Pa68nN+0
- TLSH T196E1B4F08E008D37ED9EE578B6DB8AD2F322805A7250C717A010BCFE8CCD3109A6D619
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5656 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\__pycache__\stash_capture.cpython-314.pyc1⤵
- Modifies registry class
PID:1548
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5656