419ad7644db0011fa4f2d8f5fe5b224a09c6f9b4c21a50adee064e659472bc01

Analysis

max time kernel
46s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 05:59

Target
VelostrapV3.pyc
Size 228KB
Sample260712-gpvcbsds4l
SHA256 419ad7644db0011fa4f2d8f5fe5b224a09c6f9b4c21a50adee064e659472bc01
MD5 7ac9fe09e405ee06073c1499ff7ca0f4
SHA1 0598ea3c664c9b6e6e02fa00bd3289d90c0c63ad
SHA512 6c675113523a32bb4925a77b36da2ee7cc957a3858cc75647ae87c3c41f4065cdc132aa829d48d61eb73a9cffeb45be1a4557d91fbbadff86f4855cdca9a7e3a
SSDEEP 1536:0JMhwwNswC0WtFOr0mfU2jwrkxxepItXbNIJFyJdZxwhmnEQItL1cb+z:0Twa9XuS2jwr6xepItXhIJ8dZ+AnBL2
TLSH
T19B340956F6A24471F4A7607999B10B0A3A38A1D3E7C5CF3DB3BD40792F4EC0899B1798
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4136	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\VelostrapV3.pyc
1⤵
- Modifies registry class
PID:2344

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact