4aed8bdde664b6ce0de3b70472a5918a64c2a628089ec52a80092154ee7a0546

Analysis

user interaction
yes
max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/07/2026, 03:29

Target
SlinkyLoader.pyc
Size 5KB
Sample260709-d16myscs7k
SHA256 4aed8bdde664b6ce0de3b70472a5918a64c2a628089ec52a80092154ee7a0546
MD5 87994fa07d8d94c3195e440f658e412f
SHA1 50b65ad9df8fb7e8c7fa9ae25354c4d134256876
SHA512 96089117727f8eb9edbbb9661291bbd9bb0fc3e8323b2be1d225fb7da50ee3365c9d114c333c45b6ece438c1e26bd0e7b9232688e4fc16494056fbb6682ebb68
SSDEEP 96:7fYKU2x3kw+QKnqlShjLJXDumPmEEvQxLhOwTY6bgYA7wi7CeeLlRBEBHuDQslI:ekP+ln9h3JXyEGQxLhTY6MN7V7ALlrE3
TLSH
T192C17D7573FCD159D308E83F8B01BBB875EEDAC8C41D4107A50B08D20B2328AABA44E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2852	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SlinkyLoader.pyc
1⤵
- Modifies registry class
PID:2476

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact