bc61f9e811b33f34a2b08fcca8569da1b9ba4d106b9a4a5a1d6960b6966b9061

Analysis

max time kernel
148s
max time network
102s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 16:38

Target
h.py
Size 8KB
Sample260714-t5mcwabv31
SHA256 bc61f9e811b33f34a2b08fcca8569da1b9ba4d106b9a4a5a1d6960b6966b9061
MD5 e87189baee442282bbe7e4f7395740c5
SHA1 5831aefb0a849ccb398eb0ffb576d3e86da57ee6
SHA512 30807cc5b20d54d84b45ed2b07aedbdf60bac8e751bbc61e9b49cc685764728a600407d30e08d29bb308fb1787c6aa9dcbbd29addc5a9749ba0cc52c7179338b
SSDEEP 192:w9/0LB8RT/i48S3VAed/J5C+qkWzMjtjLBQ8KQb6w2O:w9sLB8gvQZ2LQ6wV
TLSH
T1E402B7B38C8A901D9231CA6C9506FA65F317020B462B183BB9FC93262F74736D5F49A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4740	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\h.py
1⤵
- Modifies registry class
PID:2712

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact