4e683f49064bcbd13ab114bc08d3846c90d223f9667c080e06c960b54a8525de

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RavensQuest-1.4.0-pc/lib/python2.7/chardet/eucjpprober.pyo
Size 3KB
Sample260802-akbabsam3w
SHA256 4e683f49064bcbd13ab114bc08d3846c90d223f9667c080e06c960b54a8525de
MD5 9a4b44f2a942e86676d3e886c6f7ab73
SHA1 dbd00fd02e526ab2c434c175e969405c7af1e054
SHA512 a103adbbc990fb5a1cfedaf8598cf898544defdc36168f3d5d4851c485ccfedfebca86978a7abb7ebb2a6752de121dfdf7aaeb2cc4eaf4c83dcb6d8bcf06a9ac
TLSH
T1AD612390F7D4C54BD9A20135A0B6023BDEB9F5F311021B9227B457352D99219C93F9C7
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4996	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1196	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RavensQuest-1.4.0-pc\lib\python2.7\chardet\eucjpprober.pyo
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4996

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads