9692cf8b2ac7e342744b01200eb61f98b5f7a9fba8e497ed14fd0cb6d27ca9ad

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 07:31

Target
protected_nova_sniper.py
Size 27KB
Sample260709-jcdvxsey9v
SHA256 9692cf8b2ac7e342744b01200eb61f98b5f7a9fba8e497ed14fd0cb6d27ca9ad
MD5 3c376a98c589ee20210b1677c17a620a
SHA1 0be2a81fed8d31f879309d9660a5e02f5044f745
SHA512 3410c6e0f6b5ca4036b0cc40315756af5ac81c5b75dbaa2af3555918dae1f92c4ad5da03ac632ac0f2eb9c9217aa9ed15d85d0e8eca6ea45619798dac5695c5f
SSDEEP 768:v8lqubgUfnbQf+yWcxCpDPRE4Ld358Cbq1Uk61:Ulqi9y/CJPRbJ8tC1
TLSH
T190C2F1B35061C7740108052BEDCE586771F72C9E905ECAAE43ADA527C9CEC51F2AEF4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3336	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\protected_nova_sniper.py
1⤵
- Modifies registry class
PID:3668

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact