70bd5d9338a83d8401e75a100cf8988f93b5de14dd8e8e1d23250ca13084d2c2

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/07/2026, 04:08

Target
kiro-pro-free-1.0.0/kiro_bypass_token_limit.py
Size 7KB
Sample260711-eqa9qsdv7v
SHA256 70bd5d9338a83d8401e75a100cf8988f93b5de14dd8e8e1d23250ca13084d2c2
MD5 f39e987fbd7deee1bbbec2e036d4e740
SHA1 bbabc8d3ce7131e25732576f84a988b7dea37408
SHA512 d8ba3a986500d6af1d89cc9b8afbf4d56ec5471f99b5e2ce4414ba52b0bee7649c6f9582c3365113a7e57e2cb0815da533c7bce74d5b8b444f32aa7b821d6c2a
SSDEEP 96:V12VBzJHuTfzYoMswsB8eR7l9At8JTqk/KJoU/gLOZ35I/0k2Ssla:GVBlHuTfzxQm93Llqk/S14LOZVXla
TLSH
T171F154465C82289AAB070B5BD8258411B339D4FB4B646070FEEDC2D46F47B728BF15BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2692	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\kiro-pro-free-1.0.0\kiro_bypass_token_limit.py
1⤵
- Modifies registry class
PID:4600

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact