95ba91a35f303346b812d19686507fb511c7377425f9bbb2f67a98f2fd642d64

Analysis

max time kernel
8s
max time network
9s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
03/07/2026, 01:06

Target
Guevara.py
Size 13KB
Sample260703-bf6fcaet2m
SHA256 95ba91a35f303346b812d19686507fb511c7377425f9bbb2f67a98f2fd642d64
MD5 87135c9295907ec7b644f7f306d41f98
SHA1 fe1ab3a3e448e32ec561959b5a9c81f151ebda29
SHA512 2f9230538276918def761f3fcb4b011c96e60fce5e8b0c48800d1d13d8b1733bd2198e2d57be8d4b37ec0cd9aa7cd400551f84d6f121d6412dee2b4ac318a1e5
SSDEEP 384:Z+yEAnMDHIzOgWkreDk3/tjVyrSOVdW7nI90rYDZecYzuBuzSJ6zViB3rBdYjPL6:ZF+3tLB
TLSH
T14D528D709C486C24F7A0F80D012A2C309555B895FA85573EB4DC71C6ABEDE61C8DEE77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
696	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Guevara.py
1⤵
- Modifies registry class
PID:3852

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact