d664114ebb01b121873420f096d7399530360ee8a5095d854a28b70114d58e8b

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/07/2026, 08:39

Target
slitz/Programs/Discord-Server-Unban-All.py
Size 3KB
Sample260708-kkpg3adv7z
SHA256 d664114ebb01b121873420f096d7399530360ee8a5095d854a28b70114d58e8b
MD5 8c7ddb1c50df8fb50164bf9baaf0a19a
SHA1 e2fa80d3aebdbfeb8c3d7ff62e30a3f28e609cf5
SHA512 3e43cc73e9ea28a14e7ff0a78cc2bbd7579e4ac38c76b02fadeee05f0d1c3e7d52383d1dd8106f72609ec003bfd1be4c85853a52824678a525bcc23192942c56
TLSH
T1735152274D0A182F8636850C8D65D012E77B930389292203F8FC93CA6FF9471D2B52AF
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4700	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\slitz\Programs\Discord-Server-Unban-All.py
1⤵
- Modifies registry class
PID:4168

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact