Analysis
- user interaction
yes - max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/07/2026, 14:00
Static task
static1
Behavioral task
behavioral1
Sample
Flashe D$$oS.py
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Flashe D$$oS.py
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Flashe D$$oS.py
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
Flashe D$$oS.py
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Flashe D$$oS.py
- Size 1KB
- Sample260703-rayfjsav4v
- SHA256 20e786f64d346adf8e6336e99d050a3f1c10c1c569b5d6c34900c20be276ae88
- MD5 0ba9ed25e193038773e46444f0e623c7
- SHA1 7e87ff8d9b226b21778f4a5939757bc08509adcf
- SHA512 1608581d391c8b761893c7a7c2a9b69d425690ca1c5cf6e2d91cf4860a7e6b0db6776de226a8935273e652cc7d982c17280a65cce4e4065f0232c8002528237b
- TLSH T129410B37A84A7765837D4D1816B2FC2DD35226EAEA728402F4EEC1E46F79C24CC14AD1
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\py_auto_file OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.py\ = "py_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\⣊ᥥ蠀ٴ OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\py_auto_file\shell\edit OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\py_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\py_auto_file\shell\edit\command OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\py_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\.py OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\⣊ᥥ蠀ٴ\ = "py_auto_file" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\py_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\py_auto_file\shell\open\command OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\py_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings cmd.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2268 OpenWith.exe - Suspicious use of SetWindowsHookEx 33 IoCs
pid Process 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe 2268 OpenWith.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2268 wrote to memory of 3652 2268 OpenWith.exe 90
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Flashe D$$oS.py"1⤵
- Modifies registry class
PID:3696
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Flashe D$$oS.py2⤵PID:3652
-