b0cf14cb761829a96b8e5baa445bcdbc582ae13f017cf0677c02f695ba05f431

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 17:25

Target
sniper.py
Size 26KB
Sample260714-vzcf6act4v
SHA256 b0cf14cb761829a96b8e5baa445bcdbc582ae13f017cf0677c02f695ba05f431
MD5 37e4042406b54cd8b78b2bdd317f625e
SHA1 dfd57e8e572132b60ddda532f10597dec72e7c2b
SHA512 00292f0700a61fc6331d358aa1df9156463ccb62869d01ea54c6f4d5451884434bf4d652e80384d659a97969c25737aa7bc8e77b2a31b900879d344ce3267059
SSDEEP 384:U+wJmer3aaToml9vCrNmBTcPDTCqTCfzjGT6vuxgr9TCOTCQbluT+BniwBmf:U+1GDBodMK6WxgrpB5blq2nismf
TLSH
T1CEC241128C063512C37AB92C888E9751E715728F75B60A137EDCB2D42F7F02896E7D6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4568	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sniper.py
1⤵
- Modifies registry class
PID:4848

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact