c3953dde8ec1233a8eac48a75c5917557a13e168baa7434e96e7d07fbd18b046

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
external rival (1).py
Size 4KB
Sample260723-23gnlscq21
SHA256 c3953dde8ec1233a8eac48a75c5917557a13e168baa7434e96e7d07fbd18b046
MD5 5d4933a0c0e06c5c76b6855ac3fce0a9
SHA1 c50cd097bf507210fdcfe4714b66fdb7b8c400ea
SHA512 dc6180d3878acbace7c9b4f939094de3b2dcf5372e1418866b08aa5ce9c50036d2c562508587da410efe6de25f0902bb5723717f539d18ed5a6559a1aa19defc
SSDEEP 96:8CLYzETYh/4a5K/sXYzWG3wjiDuY6sEMUYzdXUpY2YAYJNaxuGL0HCQTZZ:8CLYZ4aOWG3wQbUYztUpY2BYJJ9CQTf
TLSH
T119A184069C4E4494A472C1AC71571620F79EC30758766E87F77CA3842FBD5134337AAE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2884	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4580	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\external rival (1).py"
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2884

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads