affe5d3eaaf59d031f950ca08465d30fa9838a4f7c87ff6abe16c8c5d4e8d3b8

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-fr
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-frlocale:fr-fros:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 20:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mehdi.py
Size 44KB
Sample260730-y1tzdafa27
SHA256 affe5d3eaaf59d031f950ca08465d30fa9838a4f7c87ff6abe16c8c5d4e8d3b8
MD5 255db3fb9c7eaecbfc3e1b1b4c5bc610
SHA1 2ee5bd609019636321ea5b0b97b5b136463c9c53
SHA512 fd12820486b514cbe5d1fac570edad7e76c6b2b72dcf01ed45aac9c6c99cc96822b5971ffa653f3ca5d310729b55cff7ea403447e26029f10080ffa9bb66fe20
SSDEEP 768:J/63OYCgx9ypBSkiHRJRSYdnU43SHU7F9R5/20PPSDPkjWq:J63O3gx9zHpSYdUNOL7PE8T
TLSH
T10A13F2AD8B9E58B9A86D260313723029C4C4CDDDE766DC55422715871D09371E7CECFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3864	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2592	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\mehdi.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3864

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads