61d7082265a9c00599eb1368cdce946ea9842260d40218af4bfc289b3002b141

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 12:13

Target
python313/ACSRE[92]exp.py
Size 348KB
Sample260710-pdqtrscw8x
SHA256 61d7082265a9c00599eb1368cdce946ea9842260d40218af4bfc289b3002b141
MD5 ffe4d8c9d5e71d7543f13dd7bc04cbe9
SHA1 d932cb4f550b7aeaa38744d79202b400fe602ce3
SHA512 d0ae460841b90eb5a4468a6bcfb54a18603be5855fb56d5a460e341f89c18cb8b3977a8b299b0368a5e5d5d9c9629cb7a3ad3b84394cd81dde0821126781f3c9
SSDEEP 6144:2nf/HrJMF5EuDUWjtayvaWNkOOBqWi3udG2qormi5OngapHtz6y243fJVnnkuo2p:2nHQ5d9Ki3pgmRpptPnnLV
TLSH
T16474A6845622E17E5B96CE192F43AEDC2869D9EFC5C9E701F0841A4FF0A873C94E57C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3344	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\python313\ACSRE[92]exp.py
1⤵
- Modifies registry class
PID:4112

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact