dcdc8359d6922bc93a7986c63d13f385fb62dfa82ef3a5ece802e67c4506d3e5

Analysis

user interaction
yes
max time kernel
300s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-fr
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-frlocale:fr-fros:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vortexexecutor96unc (1).exe
Size 79.4MB
Sample260802-stp4ys11e1
SHA256 dcdc8359d6922bc93a7986c63d13f385fb62dfa82ef3a5ece802e67c4506d3e5
MD5 e39b5a50051d4252034c82ce68816520
SHA1 04d6e3a8704ff4203561736c526cfc98f7abacb3
SHA512 64a20c0b10c78b23f18bb2c3286222e30708c7e53663987cc5e0a6107f971d09967551629356445e9b3725bf6c9cdaee783f78cb5c6c3db980c96359a0de106b
SSDEEP 786432:886xEsnOH0RTsCViDMdhJ22BQfZZ2eNbQgRY1aj7:8312c2uQfZ0eNbQfy
TLSH
T15B089E25A3D80217D57ECE79C2628616F7F0B4D60321CACB04A4FB492F63BD15E7B662
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	vortexexecutor96unc (1).exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\.py	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\py_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\ⷡ໡愀蠀	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\py_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\py_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\py_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\py_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\.py\ = "py_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\ⷡ໡愀蠀\ = "py_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\py_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\py_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\py_auto_file\shell\open	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
696	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 1940	696	OpenWith.exe	91

C:\Users\Admin\AppData\Local\Temp\vortexexecutor96unc (1).exe
"C:\Users\Admin\AppData\Local\Temp\vortexexecutor96unc (1).exe"
1⤵
- Modifies registry class
PID:5436

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ExtractedExe_6500433c7cf44e52bff7bb1d13df1b06\vortex executor 96 unc.py
  2⤵
  PID:1940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vortex executor 96 unc.py

Path C:\Users\Admin\AppData\Local\Temp\ExtractedExe_6500433c7cf44e52bff7bb1d13df1b06\vortex executor 96 unc.py
Size 11KB
SHA256 d0d17597fbe60ec5e089ffd12edab134df805bce1784dbf63a21166e868f3378
MD5 d50f66fa9b740e9c6955311de698e2e0
SHA1 d98b5dad8b7365306c7aa2342017a48519954fa9
SHA512 7ecae24f9c1cff7224beda60820628eae95d80e651ecb9704e9d9bc754ee25bb3a908036c72254f591c2c7a9358386d93eeb3b4b7ef8184cccf45bcb0660a4ef
SSDEEP 192:X4PDY+bEA2j9aqax7G08aEXafWU0BLcRVo/+U3lrh15/LO8tP04:X4E9A5O4k5h7LOit
TLSH
T16432A882AC5D0522E3A79388395BC0987575FCAB3A124D387AFCD3186F4D3319395BB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download